Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
-----------------
# check for the first user and add it to user wheel and then to sudoers
USER=$( grep 500 /etc/passwd | cut -d: -f1 ) GROUPS=$( groups $USER ) if ! groups $USER | grep -q wheel ; then usermod -a -G wheel $USER sed -i 's/# %wheel ALL=(ALL) ALL/ %wheel ALL=(ALL) ALL/' /etc/sudoers fi
EOF ------------
Rahul
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
I'm not sure what the point of this is honestly - you already know who the user is on the LiveCD, so you can just give them sudo in %post.
For the install case (which I think is what you're getting at here), I personally would rather fix this the Right Way(TM) for both LiveCD and installations from DVD, which is to give %wheel sudo in the sudo package, and offers an option in firstboot 'Make this user an administrator?'
The reasoning against that is that it brings up issues when using a centralized authentication service - I think that we could probably make authconfig smart enough to yank that out if that's the case.
Jon Stanley wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
I'm not sure what the point of this is honestly - you already know who the user is on the LiveCD, so you can just give them sudo in %post.
Sure but I am not talking about this at all. Only for the install case.
For the install case (which I think is what you're getting at here), I personally would rather fix this the Right Way(TM) for both LiveCD and installations from DVD, which is to give %wheel sudo in the sudo package, and offers an option in firstboot 'Make this user an administrator?'
Adding more things to firstboot can hardly be considered ideal or the right way. Even so, for the desktop use case, I think what I am posting makes sense and can be done right away. The "ideal" solutions and other use cases have been used as a impediment for way too long. As a reminder,
http://blogs.gnome.org/halfline/2007/08/18/experimental-livecd/
Rahul
Jon Stanley wrote:
The reasoning against that is that it brings up issues when using a centralized authentication service - I think that we could probably make authconfig smart enough to yank that out if that's the case.
I don't understand this reasoning. What does membership of the wheel group for the first user being configured on the local system have to do with remote or centralized authentication?
Kind regards,
Jeroen van Meeuwen -kanarip
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
I agree the overall concept makes sense. Some questions to consider:
1) Are we too far into the F10 process for this? 2) How does this interact with the default PolicyKit configuration? 3) How do other important OS vendors use sudo, is there a chance to harmonize a bit? 4) Does it still make sense to have a root password (and root account)?
I don't know the answers to these offhand - my initial thought on #2 is that it would make sense to have PolicyKit use the user's password for authentication if they're wheel (and ideally not prompt for passwords at all for OS updates, maybe a few others). On #4 I don't think it makes sense to have root by default if we do this, but that requires anaconda changes.
On 10/04/2008 08:09 PM, Colin Walters wrote:
- Does it still make sense to have a root password (and root account)?
Of course!
Isn't the strong point of Unix/Linux/etc. the security model where one makes a *distinction* between ordinary user and the "super-user" root?
I.e. why make a user the "super-user", or make one user be able to use all root's commands simply by using sudo? This means that if the users password gets known, that persons account will get you the same privileges as root.
Why not instead try to educate people to use a really strong password for root, only use root when necessary, and perhaps teach them to add certain not-that-dangerous-commands to sudo?
For me it looks as if you want to go away from the security model used for years, I ask myself, why?
/Lars
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
I agree the overall concept makes sense. Some questions to consider:
- Are we too far into the F10 process for this?
It's a fairly simple change. You can stick it in the current ks file and do a compose and test or if you want me to do that and post a image for further testing, I can.
- How does this interact with the default PolicyKit configuration?
PolicyKit configuration should be tweaked to accept user password like you said but I don't know about the details much.
- How do other important OS vendors use sudo, is there a chance to
harmonize a bit? 4) Does it still make sense to have a root password (and root account)?
Are you asking about disabling the root account by default? Not possible without Anaconda changes and at this point, I wouldn't think about anything major for this release atleast.
Rahul
2008/10/5 Rahul Sundaram sundaram@fedoraproject.org:
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
I agree the overall concept makes sense. Some questions to consider:
- Are we too far into the F10 process for this?
It's a fairly simple change. You can stick it in the current ks file and do a compose and test or if you want me to do that and post a image for further testing, I can.
- How does this interact with the default PolicyKit configuration?
PolicyKit configuration should be tweaked to accept user password like you said but I don't know about the details much.
- How do other important OS vendors use sudo, is there a chance to
harmonize a bit? 4) Does it still make sense to have a root password (and root account)?
Are you asking about disabling the root account by default? Not possible without Anaconda changes and at this point, I wouldn't think about anything major for this release atleast.
I used to always lock the root account and use sudo myself, but AFAIK the system-config-* tools for example can't be set up to use sudo instead of the root passoword. (Debian, Ubuntu and Arch Linux, for example, use gksu for similar tools, which can be configured to use either.) Since I didn't want multiple ways to get root privileges and I still wanted to use the system-config-* tools from the menu, I had to stop using sudo. I quickly got used to using the root password, though.
I don't mind if Fedora uses sudo or a root account for getting root privileges, but I'd very much like it to be consistent. Ubuntu does this by having every management tool support sudo and always asking for the user's password. Fedora has always asked for the root password, which I like, too.
I'm not a security expert, but I think it would be best to have just one way to get root access. One important password. Or with sudo, where I could just decide which users could run admin tools, instead of just the users who know the root password.
What I wouldn't like is a mess where I would sometimes enter my own password and other times the root password, depending on the tool. If this could be avoided just by not opting in for the sudo setup during the installation, that is ok.
This ended up being a little rant-ish, but well, I think adding sudo to the default setup is not a small change and is worth being thought and planned well ahead before doing it.
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Sure. Do you want me to do that?
Adding some info on PolicyKit and console helper plans for integration with sudo would be good.
Rahul
On Wed, Oct 8, 2008 at 3:40 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Sure. Do you want me to do that?
Adding some info on PolicyKit and console helper plans for integration with sudo would be good.
I can do that part.
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Hey, are you doing this still?
Rahul
On Mon, Jan 5, 2009 at 10:28 AM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Hey, are you doing this still?
Do we have a feature proposal?
Colin Walters wrote:
On Mon, Jan 5, 2009 at 10:28 AM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Hey, are you doing this still?
Do we have a feature proposal?
Not yet. Do you want me to create one? The biggest difficulty is the use of consolehelper (which has no support for sudo).
Rahul
On Wed, 2009-01-21 at 16:58 +0530, Rahul Sundaram wrote:
Colin Walters wrote:
On Mon, Jan 5, 2009 at 10:28 AM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Colin Walters wrote:
On Sat, Oct 4, 2008 at 12:14 PM, Rahul Sundaram sundaram@fedoraproject.org wrote:
Hi
You can add the following snippet to the fedora-desktop ks file into a init script to make sudo just work for the first user. It can't be added to %post since firstboot wouldn't have launched then. Let me know what you think:
So, consensus to revisit this for F11? We can go ahead and make a feature page now with the plans.
Hey, are you doing this still?
Do we have a feature proposal?
Not yet. Do you want me to create one? The biggest difficulty is the use of consolehelper (which has no support for sudo).
Why not add the first user to wheel instead? It's easily changeable programmatically, and would mean that PolicyKit would do the right thing.
Cheers
On Wed, 2009-01-21 at 16:42 +0000, Bastien Nocera wrote:
Why not add the first user to wheel instead? It's easily changeable programmatically, and would mean that PolicyKit would do the right thing.
This is what I do with my users as well. Of course, we'd also have to get the sudo maintainer to set that config by default (allowing wheel users sudo access).
Bastien Nocera wrote:
Why not add the first user to wheel instead? It's easily changeable programmatically, and would mean that PolicyKit would do the right thing.
Does adding the user to wheel, make various system-config* that are still not using PolicyKit ask for the user password instead of the root password?
Rahu;
desktop@lists.stg.fedoraproject.org
-
Bastien Nocera -
Colin Walters -
Jeroen van Meeuwen -
Jesse Keating -
Jon Stanley -
Joonas Sarajärvi -
Lars E. Pettersson -
Rahul Sundaram