Sudo, a love hate relationship


For better or worse, I have a love hate relationship with sudo. As a unix systems administrator need access to do my job. Usually that means that I require access to root. As such, I hate anything that I perceive as getting in my way, including sudo, and su. Sometimes, especially for other teams, that means access to another account, i.e. Oracle for the DBA(s). However, as we all know, sharing accounts removes accountability. Further, for multiple reasons it's against best practices to directly log in as the shared accounts. So, what do you do, prevent direct logins to shared accounts by forcing people to log in as themselves and then "su" to the shared account? Sure, this will work, but it still leaves the shared password issues. Or you could use sudo, which lets people access shared accounts with out having the shared password issues.

Maybe, as an admin, I do have a God complex like the stereotypes say, but for what ever reason, I don't like it when things get in my way and either slow me down, or worse, prevent me from being able to do my job. So, having to stop and provide additional credentials is, in a word, annoying, at best. At worst, additional authentication can turn what would otherwise be something to be automated in to a manual process. (See my separate Automate what you can and do the rest manually post for more details.) Su, is simple enough, you just have to know the password of the account you are trying to use, simple enough and there's not much to break. Sudo on the other hand, is an entire sub-system, which may seem like a lot of effort to set up just so that a systems administrator can do his (or her) job. Further, the sudoers file can be somewhat fragile, all be it rightfully so. Sudo's predilection to failing secure if something makes it unhappy. Most often, the thing making it unhappy is someone borking the sudoers file contents, or the permissions of the file, or the parent directory, or the parent's parent directory, etc. There are even edge cases where something much more nefarious will break sudo, thus hindering you from having the access required to fix it.

Unlike most people, I will take the time to set up my working environment to make it easier and more conducive for me to do my job. This can be from anything like customizing the shell prompt, to writing scripts, or even so far as how I interact with sudo. In fact, the way that I now interact with sudo makes me more efficient than I was with su. How am I doing this? I'm taking the time to customize my environment just a little bit more than I had before, namely aliases and ssh key agent based authentication. (See my separate Embracing sudo article for more details.)