Hello,

Moved to the Security Forum. THere are a couple of things you can do....

Defaults syslog=auth
Cmnd_Alias SHELLCMD=!/bin/*sh,!/usr/*/*sh,!/usr/*/*/*sh
Cmnd_Alias SUDOERS=!/bin/* /etc/sudoers*,!/usr/* /etc/sudoers*,!/usr/*/* /etc/sudoers*
Cmnd_Alias SUCMD=!/bin/su,!/bin/* /bin/su*,!/usr/* /bin/su*,!/usr/*/* /bin/su*
Cmnd_Alias USERCMD=/usr/sbin/useradd,/usr/sbin/userdel,/usr/sbin/usermod
Cmnd_Alias NOUSERCMD=!/usr/sbin/useradd,!/usr/sbin/userdel,!/usr/sbin/usermod
%wheel ALL=/*bin/*,/usr/*bin/*,SHELLCMD,SUDOERS,SUCMD,NOUSERCMD
idmgmt ALL=USERCMD

You can easily add in capabilities to all idmgmt to manipulate group's as well. But these should work for you. Note, that we have disable su capability as well as the ability to edit sudoers for anyone in %wheel, mainly because su is not audited. You may need to allow visudo by someone to make the necessary changes.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast

Hello,

Considering that ESX 3.5 does not understand noexec that may be difficult. Not sure about vSphere but I have a feeling it does.... Run sudo -V | grep "dummy exec" to determine if the support is compiled in. Remember NOEXEC may or may not protect you, it depends on how programs were compiled or not. It is not a cure all but will protect against shell escapes from things such as VI. So if it is there, I would use it.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast

Hello,

On a stock 3.5 system the command 'sudo -V | grep "dummy exec"' returns a blank line. THis implies that noexec is not supported within this version of sudo. Also, if you do a 'man sudoers' you will also find no reference to NOEXEC. Remember, 3.5 SC is really RHEL3 U8 and a 2.4 kernel. It is a bit old....

If you modify the stock 3.5 system to add your own sudo, you can get the noexec feature. Not something I really do.

Instead I would investigate the use of the hytrust appliance, or use the VIC as much as possible. That way the issue does not come up much.

NOEXEC for example can be used to prevent calls to shells from within VI, the way I do this is NOT allow VI or any editor to be used. Instead you copy the files, modify them, then copy them back in. There are quite a few ways to get what you need from sudo.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast