<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi David,<br>
<br>
This is interesting. So you want them to be able to run lots of
different binaries on the system, but nothing that would let them
exec() or system() a shell? I think sudo is probably the Hard Way to
try to do something like this. May I suggest an alternate approach.<br>
<br>
This USENIX paper from LISA11 (Local System Security via SSHD
Instrumentation)
<a class="moz-txt-link-freetext" href="http://static.usenix.org/events/lisa11/tech/full_papers/Campbell.pdf">http://static.usenix.org/events/lisa11/tech/full_papers/Campbell.pdf</a>
describes the authors' use of the Bro IDS combined with sshd
instrumentation to detect unauthorized use of their systems. They
needed a way to tell legitimate use apart from hackers or other
non-authorized uses, and it turns out an IDS with pattern-matching is a
good tool for that sort of thing.<br>
<br>
I realize this doesn't exactly answer your question but it is an
alternate approach to flexible security which still allows people to do
legitimate work without anything getting in their way, and the admin
gets notified as soon as something "smells" weird to the IDS.<br>
<br>
HTH<br>
Jim<br>
<pre class="moz-signature" cols="72">--
Jim Ockers, P.E., P.Eng. (<a class="moz-txt-link-abbreviated" href="mailto:ockers@ockers.net">ockers@ockers.net</a>)
Contact info: <a class="moz-txt-link-freetext" href="http://www.ockers.net/">http://www.ockers.net/</a>
</pre>
David L. Willson wrote:
<blockquote
cite="mid:0455a966-49bf-4594-bb18-656c31610561@zimbra.thegeek.nu"
type="cite">
<style type="text/css">p { margin: 0; }</style>
<div
style="font-family: Times New Roman; font-size: 12pt; color: rgb(0, 0, 0);">Has
anyone out there got a sudoers file with a reasonably complete set of
blocks against shells, etc. ? I realize it's not secure. I'm just
trying to clearly communicate disapproval for interactive privileged
sessions.<br>
... so that if/when someone circumvents it, and if/when I detect the
circumvention, the user isn't surprised that I confront them and/or
report it to their manager.<br>
<br>
<br>
</div>
</blockquote>
<br>
</body>
</html>