5

I reached the end of the internet with no success, so now I turn to you guys.

What I'm after is a way to implement four eyes principle on the OS level for certain commands in Linux.

Example : The admin group has 10 members. The reboot command should not be allowed to be performed by any one admin alone, but should require a second admin to enter his/her credentials as well.

Work-flow : Admin A runs "sudo reboot". Terminal prompts for Admin A password. Terminal prompts for Admin B username and password. If both users are in the admin group, the command will run.

I have started to look into PAM, but couldn't find any immediate way to do this.

Does anyone know how to do this?

|improve this question

closed as off-topic by M'vy, Jens Erat, Mark, RoraΖ, schroeder♦ Feb 18 '15 at 21:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – M'vy, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You should be able to do this with PAM, but no there's no "immediate" way to do it. Anyway, this is more of a development question than a security question. – M'vy Feb 18 '15 at 10:28
3

I don't know of a packaged solution to do this. I expect it would be quite tricky to do, as you need a two-step request/approve system, and there is nothing like that in standard Linux systems.

One possibility is to use an out-of-band two-man system. For example, the reboot command could require an additional password. One half of the admins know that password; there other half have the rights to run reboot. To actually do a reboot, two admins would have to work together. Even this is a bit tricky - and flawed if the second admin writes down the password.

I've never seen this done in practice though, and I'm not sure it's a sensible thing to try and do. In general it is almost impossible to lock down admins, as they need high level rights to do their job. What is more practical is locking down administrator access, e.g. an admin's account is normally disabled; it is only enabled (by a separate team) when the admin is dealing with an authorised change or incident.

|improve this answer
  • I thought about that two-part system, but it's a bit of a hassle, and knowing how lazy people are, they would just put it all on a whiteboard. An admin is an admin, and should have high level clearence, but what I would like to invoke is some sort of shared responsibility to force people to think. We have way too many admins doing stupid stuff, and I think that having to ask another admin to put his name on it, the second admin would like to know what you're up to, and make sure things are done correctly. Thanks for helping! – Andreas Feb 18 '15 at 13:04
  • 1
    @Andreas found another solution( posted it as a answer below) , but reading through this comment if someone is running around doing stupid things to production systems then the more prudent question should be "should this person have admin access in the first place ? " – Damian Nikodem Feb 18 '15 at 15:50
0

What you want is 2 factor authentication implemented via pam, a quick Google shows this: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication

With a slight modification you can setup a second admins phone ( and the first admins password ) for auth in the sudo config. If this isn't enough information to directly answer your question I can provide a step by step guide when I am not on a mobile device in a few hours.

It should also be possible to enforce 2 seperate tokens ( e.g. Codes from 2 seperate phones ) with a strict timeout.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.