Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading the this question over on Ask Ubuntu and they suggest adding the following line to etc/sudoers so that you're not prompted to enter your password each time you run sudo

%admin  ALL=(ALL) NOPASSWD:ALL

Is this a security risk and if so, what are some ways people can exploit this?

share|improve this question
2  
Yes, it's a security risk, but if somebody gains access to an account of the admin group, you're already in trouble. It's rather easy to create an alias that executes malicious code that will be executed the instead of the actual sudo command. – Dennis Jan 9 at 6:23
    
-1, obvious question. – Quora Feans Jan 9 at 13:23
    
@QuoraFeans The fact that it's an obvious question does not mean that it is a poor fit for the site. We're not just a collection of non-obvious questions, and anything but the most trivial questions has a place here. – Nzall Jan 9 at 15:10
up vote 24 down vote accepted

Yes, it's a risk. Anyone who touches your keyboard can get root access by running sudo and not worrying about your password. Anyone who has an exploit that gets them userland access can instantly get root access using the sudo command. This reduces isolation and increases the effort to recover from an attack or intrusion.

share|improve this answer
2  
Good thing this is isn't done by default on the world's most used VPS....... oh, wait... – Billy C. Jan 9 at 9:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.