Re: [SAGE] Security tokens

[Steve Simmons <scs@lokkur.dexter.mi.us>]

On Tue, Jan 21, 2003 at 09:57:01AM -0800, Ted Cabeen wrote:

> We try to use sudo for sysadmin tasks here too, but you need to make sure that
> your policy is flexible enough to deal with the specifics of your systems as
> well.  We discourage the use of "sudo <shell>" because it breaks auditing, but
> we have to use it from time to time when we need to glob through a set of
> non-world readable/executable directories.

Op is your friend.  It's like sudo in many ways, but lets you take much
finer grain control.  For example, on my home machine anyone in group
'family' was able to do 'op shutdown' or 'op reboot' and reset the system.
See ftp://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/op/op-1.11.tar.gz.
The tarball contains a paper about op, a man page, and sample config files
as well as the source.

Configuration can occasionally be difficult, depending on how subtle you
want to get.  But it's much much safer than permitting "sudo <shell>".