execute remote commands with sudo #54

New Issue

ungleich-gitea · 2021-11-20T11:25:15Z

ungleich-gitea commented

2021-11-20 11:25:15 +00:00

more and more I'm in situation where I don't get root with VM or it's even forbidden to do sudo -i. there are many reasons for that. from overzealous security policy writes who see root as root of all evil to monitoring and auditability of operator actions. YMMV of course, but we can't ignore the fact that this is happening and it's a new norm just like Gospel of systemd brought to you by Church of Lennart.

fun fact is that sudo is often allowed without password in situations where all non-system users present in system are admins anyway. shared systems with some users in sudoers group is different issue and isn't in scope imho.

what must be done:

all necessary files must be copied to executing user's context in target host (~/.cdist/exec?). imho that should be default even if we use root.
directories and files in executing user context must be create without sudo
remote code must be executed with sudo

discuss.

more and more I'm in situation where I don't get root with VM or it's even forbidden to do ``sudo -i``. there are many reasons for that. from overzealous security policy writes who see root as root of all evil to monitoring and auditability of operator actions. YMMV of course, but we can't ignore the fact that this is happening and it's a new norm just like Gospel of systemd brought to you by Church of Lennart. fun fact is that ``sudo`` is often allowed without password in situations where all non-system users present in system are admins anyway. shared systems with some users in sudoers group is different issue and isn't in scope imho. what must be done: 1. all necessary files must be copied to executing user's context in target host (`~/.cdist/exec`?). imho that should be default even if we use root. 2. directories and files in executing user context must be create without sudo 3. remote code must be executed with sudo discuss.

ungleich-gitea commented

2021-11-20 15:31:50 +00:00

yeah, something like $TMP/cdist-$USER with mode 0700 would be nice too.

yeah, something like `$TMP/cdist-$USER` with mode `0700` would be nice too.

ungleich-gitea commented

2021-11-20 15:31:51 +00:00

Not sure whether I like ~/.cdist/exec.
I'd propose to use /tmp for temporary files. It is also always writable by users.
If permissions are a concern the cdist temp directory could be owned by the executing user and have mode 0700.

Not sure whether I like `~/.cdist/exec`. I'd propose to use `/tmp` for temporary files. It is also always writable by users. If permissions are a concern the cdist temp directory could be owned by the executing user and have mode `0700`.

ungleich-gitea commented

2021-11-20 15:31:52 +00:00

It isn't.

For example, how would you write --remote-copy with sudo? :)

It isn't. For example, how would you write `--remote-copy` with sudo? :)

ungleich-gitea commented

2021-11-20 15:31:54 +00:00

@ander You can use --remote-exec/--remote-copy custom settings to do it with sudo/non-root user. Or this isn't enough?