BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

The Demands of Compliance vs. the Ease of sudo

Posted May 26, 2011    Peter McCalister

Ah, sudo! What better way for administrators to eliminate the proliferation of the root password throughout IT and development organizations? What better alternative to using root accounts to perform routine maintenance on Unix and Linux systems? Just grant users the proper permissions in the local sudoers files and you’re in business. Oh, and the utility is free. What’s not to love?

As it turns out, deploying sudo isn’t as trouble-free as it may seem. Sure, sudo is a far better practice than the rampant use of root, but that’s not exactly the bar any security professional should be measuring internal IT processes against.

One of the problems with sudo is the ease in which it can be deployed haphazardly, without a lot of forethought, to address a particular day’s privilege challenges. Mary needs to manage the office printers. John needs to reset passwords for people in the business unit he supports. Janice needs to perform server maintenance. The admin that restricts access to the root password without a ready alternative will become popular indeed, and not in a good way.

Enter sudo as that ready alternative. Privileges can be granted quickly, independently, with minimal effort. But before you know it, one privilege request processed on top of another leads to a hodgepodge of poorly maintained sudoer files, all hosted on local servers with local log files and no audit trail to speak of. Better than the proliferation of the root password? Sure, but by how much?

Now consider the compliance implications. Many companies have standard compliance policies for sudo, most of which require routine inspections of each sudoer file to ensure that permissions granted to each user are appropriate. Not an easy task when the server count is in the hundreds or more. Many organizations find that a spot check of sudoer files reveals permissions for users who have long since left the company – a guaranteed audit violation.

In reality, there is no substitute to carefully creating a privilege delegation strategy and designing a rollout plan that ensures security and compliance while minimizing the impact on users. While this can be done with sudo just as it can with commercial tools, the fact is that commercial tools provide better guardrails around deployment and more sophisticated native features, such as encrypted logging and centralized policy stores, for enabling security protections and ease of maintenance. And the most robust ones provide an easy path to proving compliance, a challenge most administrators of sudo deployments find all too formidable.

Leave a Reply

Additional articles

BA_Hacked

British Airways Executive Club Member Accounts Hacked

Posted March 30, 2015    Brian Chappell

British Airways has released information regarding the hacking of a number of their Executive Club (BA’s frequent flyer programme) member’s accounts.

Tags:
, , ,
webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,
dave-shackleford-headshot

Why You Still Suck at Patching…and How to Turn Your Life Around

Posted March 25, 2015    Dave Shackleford

Live webinar | March 26, 2015 | 10am PT/1pm ET | Dave Shackleford, SANS Instructor | Why You Still Suck at Patching…and How to Turn Your Life Around

Tags:
, ,