After 9 years since the formation of the 1.8.x branch of sudo, the release of a significant new version of the utility used to organize the execution of commands on behalf of other users was announced , the new version being "sudo 1.9.0" and which also marks a new branch.
Sudo is the most essential and widely used utility in Unix-like operating systems, such as Linux, BSD, or Mac OS X, because, as mentioned, it allows users to run programs with the security privileges of another user (usually the root user) safely, thus temporarily becoming a superuser.
By default, the user must authenticate with their password when running sudo. Once the user has authenticated, and if the /etc/sudoers configuration file allows the user to access the required command, the system executes it.
There is an option to enable the NOPASSWD parameter to avoid entering the user password when running the command. The /etc/sudoers configuration file specifies which users can run which commands on behalf of which other users.
Since sudo is very strict with the format of this file and any errors could cause serious problems, there is the visudo utility; This option is used to check that the / etc / sudoers file is not being used from another session of the root user, thus avoiding multi-editing with possible file corruption.
Main news in Sudo 1.9.0
This new version highlights the work done to provide the background process " sudo_logsrvd " to the system , which is designed for centralized logging of other systems . By using `sudo` with the ` --enable-openssl` option , data is transmitted over an encrypted communication channel (TLS).
Logging is configured using the log_servers option in sudoers , and to disable support for the new log sending mechanism, the options " --disable-log-server " and "--disable-log-client" were added.
In addition, a new type of "audit" plugin has been added , which sends messages about successful and unsuccessful calls, as well as any errors that occur. A new type of plugin has also been added that allows you to connect your own login controllers that do not rely on the standard functionality. For example, a controller for recording logs in JSON format is implemented as a plugin.
A new type of " approval " plugin has also been added, which performs additional checks after a successful basic rule-based authorization check in sudoers. Multiple plugins of this type can be specified in the configuration, but confirmation of the operation is only issued when it is approved by all plugins listed in the configuration.
In `sudo` and `sudo_logsrvd` , an additional log file is created in JSON format, reflecting information about all parameters of the running commands, including the hostname. This log is used by the `sudoreplay` utility , which allows you to filter commands by hostname.
The command line argument list passed through the SUDO_COMMAND environment variable is now truncated to 4096 characters.
Other notable changes from the announcement include:
- The sudo -S command now prints all requests to standard output or stderr, without accessing the terminal control device.
- To test the interaction with the server or send existing logs, the sudo_sendlog utility is proposed;
- Added the ability to develop sudo plugins in Python, which is enabled during compilation with the option «–Enable-python«.
- En sweats, instead of Cmnd_Aliases, Cmd_Aliases Now it is also valid.
- New settings added pam_ruser and pam_rhost to enable / disable setting the username and host settings when setting up a session via PAM.
- It is possible to specify more than one SHA-2 hash on a comma-separated command line. The SHA-2 hash can also be used in sudoers in conjunction with the "ALL" keyword to define commands that can only be executed when the hash matches.