I had a question on users inheriting SUDO capabilities of another account. Let's say that there are three users A, B, and C. A has access to Sudo into B. B has access to Sudo into C. Does this give A access to sudo into B and then sudo into C.
A -> B
B -> C
A -> B -> C ?
Another example. My config in Sudoers file are as follows:
root ALL=(ALL) ALL
userA ALL=(root) ALL
Would the configuration allow userA to SU to root and then SU into all other accounts??
I tried googling it but all I kept getting was ways to setup the sudoers files. Any help would be appreciated.
Yes it would. But since root virtually owns everything anyway, once somebody has root access they own the entire box. So why worry about going into another account, other than to cause problems with email masquerading or something like that?
Giving root the way you did is a terrible idea. The idea behind sudo is 'least privilege' - give UserA just the access they need, absolutely nothing more.
The account userA can directly issue:-
sudo su - userC
sudo shutdown
sudo rm -r /unix /boot
sudo vi /etc/passwd /etc/shadow
..... indeed anything you can think of. Yes, it might be logged via syslog, but they can edit the output to cover their tracks. You effectively have userA as a full privilege account. What does userA actually need to do?
If you are nervous of (and should be) giving out commands such as cp, rm, mv, vi, ftp etc. (especially as you can escape to a shell in the latter two) because you can then attack everything, then script up what is allowed and give them access to sudo-execute (not alter) the script meaning that they don't have direct access to the commands.
Give away as little as possible, after all it's you that will have to put it all back together again if they break something (intentionally or in error) if you still have a job. I don't want this to be scary, but would you give a local builder full access to your bank account to and trust them only to withdraw what they are owed?
Robin