How can root and administrator privileges of different systems be delegated on one account?
In this expert response, Joel Dubin discusses how corporations can manage "superuser" accounts by delegating root and administrator privileges.
On a Unix systems, for example, an ordinary user -- without administrative privileges -- can use "sudo" to run a utility program that can only be run normally as administrator. The user is only allowed to run that single program as an administrator without being granted higher access for anything else. The same is true for "runas" in Windows. In Unix, the user types "sudo" at the command prompt and is asked for the regular password to their account. In Windows, the user right clicks on the application and chooses "runas" or types "runas" at the command prompt like Unix.
The elevated access is only allowed for running that particular application. Once the user logs out of that application, he/she loses their elevated privileges.
There is a key difference, however, between sudo and runas. Sudo can be finely tuned through the /etc/sudoers property file. Runas can't be customized at the same granular level. The danger with runas is that a malicious user could get access to any application on the system and have complete control of the machine.
Sudo, on the other hand, can be finely tuned to only allow specific users to do certain tasks and, even then, with restrictions. Every user that wants to use sudo has to be added to the sudoers property file and then have the specific privileges spelled out next to the entry with their name.
But there are two caveats with sudo, as well. The sudoers property file should be edited with a tool called visudo, which checks syntax and prevents different administrators from overwriting each other's changes to the file. The other caution is to make sure no user in sudoers is given unlimited administrative access to all applications. That would be the same as giving them full administrative rights and would open the candy store, if the user had malicious intent.
Symark Software offers a commercial product, PowerBroker, to securely delegate root privileges.
For more information:
Dig Deeper on Identity and access management
Related Q&A from Joel Dubin
How to use a public key and private key in digital signatures
Ensuring authenticity of online communications is critical to conduct business. Learn how to use a public key and private key in digital signatures ... Continue Reading
What's the purpose of CAPTCHA technology and how does it work?
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums ... Continue Reading
Single sign-on best practices: How can enterprises get SSO right?
Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good ... Continue Reading