🚀 go-pugleaf

On 06/09/2018 03:18 AM, Jorgen Grahn wrote:
> Most of those don't need root privileges for reading (although some Linux 
> distributions annoyingly put them in /sbin and don't put /sbin in $PATH 
> for normal users).  I think it's useful to have them available and to 
> know you cannot break anything unless you specifically choose to.

I do a LOT of things where I dynamically reconfigure the network or 
other similar things for virtualization labs.  As such, I find that I 
need write access to ip a LOT.

> I'd worry about scripts picking up the wrong copy of ip, netstat and 
> friends, and run stuff as root (and log a sudo use) when they really 
> just want read access.

Ya.

About the only time I've been burned by that is the differences in 
behavior of running "hostname" with options on Solaris as non-root vs 
root.  Former (silently) fails.  Latter changes the system's hostname.

> My time to stick my neck out:
> 
> I don't like sudo.  I'd much rather su to root in a separate shell, 
> and carefully do my privileged work there, then log out when I'm done.

I can respect that.

My biggest issue with that is su requires knowing root's (or the target 
user's) password.  This is okay on a single user machine.  This is NOT 
okay on multi-user systems.  This is problematic when you have many 
different teams that need to administer different parts of the system 
and all share root's credentials.

On the other hand, sudo does NOT need the target user's password (by 
default).  Instead you confirm who you are to sudo and then it allows 
you to run things.

> I don't want dangerous command lines to end up in my shell history, 
> where I can by accident execute them again and (if I ran sudo recently) 
> have them execute without warning.

Fair.

I've mostly gotten numb to that.  For better or worse.

> Sudo blurs the distinction between me and the root user, it seems to me.

Does "su" blur the distinction?  Both su and sudo cause commands to be 
run as a different user (root by default).

Or is it the fact that you start a shell as the other user?  Be it via 
"su -" or "sudo -i".

Would "sudo -i" be blurry for you?  Or is that better because you're in 
a root shell?

> That way I also don't have to understand the sudo config files.

Many (if not most) people don't need a super fancy sudoers file.  In 
fact, what most Linux distributions ship with is sufficient.  If you're 
in $GROUP, you can have sudo access.

If you work for a company and need something more complex, you'll likely 
get some training on how to manage the sudoers file.

> I was going to mention aliases as an alternative, but that's a valid 
> point.  Aliases are a bit ... unorthogonal.

I use a number of aliases.  But they tend to be for me being lazy.  I.e.

alias ag='apt-get'

By the way, I've got apt-get working via sudify too.  —  I frequently 
install / uninstall things too.

;-)

> Yes.  I haven't encountered any "false twins" like that in recent decades, 
> though.  Debian Linux (and probably others) has the /etc/alternatives 
> system for when e.g. you have two different vi clones installed; I use 
> that one.

Ya.  I tend to change the editor from nano to vim.

> /etc/alternatives is system-global though, so if I was on a multi-user 
> system where the sysadmin declared that Vim is the right vi and I wanted 
> nvi instead, I might consider doing what you do.

Yep.

> Same here, of course!  Whatever I write in this thread has a bunch of 
> "IMHO" and "YMMV" attached to it.

ACK

> I found it interesting to read about how you structure your environment.

:-)



-- 
Grant. . . .
unix || die