sudo

You seem to think sudo adds security even when you don't use a sudo password.

Re: Multiplatform Sudo - you bring up a really good point, which is that sudo, a multi-platform utility; It really didn't belong in base.

Remove the last line in your /etc/sudoers with visudo if you don't want permanent passwordless sudo on your account.

Does anybody can use sudo in a way that it adds additional but limited privileges to certain user groups securely?

You should be auditing everything already, and adding in sudo now adds another attack vector.

Create a normal user, DON'T add them to the sudo group (or any other special group), and then generate keys for them.

This makes both 'sudo' and root's ssh keys as accountable as one could ask for, I think.

Then a basic suid program (or sudo rule) that writes zero or one to the file, and you can control everything without a root.

You're absolutely right that sudo doesn't make an audit trail more worse.

I'd also recommend still requiring a sudo password on the other end and sending auth events to a auditing server.

Just one non trivial example: I can secure Ubuntu against sshd attacks pretty good and easy with `sudo apt-get install fail2ban`.

I'd think the complexity side of the sudo strategy is self-evident, so perhaps I'm not understanding the part that needs explaining.

Maybe you are used to using sudo, but there is no reason the "oh noes, now I need to be careful mode" has to be a privilege escalation command on the host your are administrating.

> It protects you from yourself in the sense that you are meant to think about what you type if it begins with "sudo." How about you write a shell script on your own system, call it "sudo", and have it do "ssh root@admin.system $*"?

(As I could ask for, anyway.) It protects you from yourself in the sense that you are meant to think about what you type if it begins with "sudo." If you are running as your own user, it's much harder for a stray 'rm' to bring down the system.

In terms of number-of-time executed, in a recent environment that I was in, in which approximately 100 or so people had sudo rights, 90+% of the time it was to allow people in various group to run commands like "tcpdump" or "netstat", without giving them full root rights to the system.

Sudo can't provide a dependable audit trail because it is trivially circumvented ('sudo bash').

Sudo waits and returns the exit code of the process.

I'd put good money on you wanting to get Doas/Sudo working before you get Python working or the bajillion different runtimes that all the utils are written in.