I've recently started to use my GitHub account as a way to synchronize my various config files across computers, including my /etc/sudoers. Are there any security vulnerabilities that this exposes?
Edit: If it makes a difference, I'm on 14.10.
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
My initial reaction was to say it's a bad idea. However, having looked at your specific personal sudoers file, I'd say, no; it looks pretty standard for an Ubuntu system. You're not exposing any of
I quickly looked at the other config files in your GitHub repo and they seem fine -- for the moment! For the future, you'd have to very careful when changing your config files, always remaining conscious that such changes will be public.
In general, I'd prefer to use a private repo to save having to think about the possible ramifications of each and every change being committed. I have my own remote repos set up on my personal Ubuntu server for this reason but AIUI, Bitbucket provide free private repos.
I don't actually store
/etc files in my repos. For re-running changes to configuration files, I make those changes using
sed commands, e.g., to automatically change the amount of information being reported by logwatch, I run:
sudo sed -i.bak "s/^Detail.*$/Detail = High/" /usr/share/logwatch/default.conf/logwatch.conf
To add an email alias for webmaster if one doesn't already exist, I run:
grep -i webmaster /etc/aliases || sudo sed -i.bak '1 a\webmaster:\troot' /etc/aliases
I also use a package called etckeeper to keep track of all changes to the
/etc directory tree using git. However, so far I've only ever used it as a historical record for the system in question and as a means to roll back any changes to
/etc which don't work out. It has an option to push its commit to a remote repo but haven't (yet) used it.
Other more complicated solutions (which I haven't yet got around to learning) are configuration management tools such as Chef or Puppet which can be used for quickly recreating system configurations.
I would advise you not to publish anything in a public repository, which is located in the
/etc directory. This information will make you vulnerable in the worst case. The risk that you overlook a file containing sensitive data is too large.
Maybe it's enough if you only commit the data, but do not push. Then the changes are saved locally.