The sudo fraud

Even with unlimited, no-password required sudo, it provides a valuable addition: audit logging.<p>every command you run with sudo is logged, along with the user than ran it. On GCP each end user is provisioned a separate login user, and logs can be shipped to Stackdriver Logging where they cannot be modified. This makes access really verifiable.

There&#x27;s one very good reason to use sudo instead of being in a root shell: audit trails. sudo logs its invocations. While you could always see who is becoming root, you&#x27;d have to look through root&#x27;s shell history to see what&#x27;s happening (which isn&#x27;t hard to purge - one of the many reasons a remote syslog server may be called for).

&gt; Is it really simpler for you to type sudo all the time rather than having one terminal tab open with a root shell?<p>Yeesh. Privileged work I do is typically interleaved with commands that do not need to be privileged. Actual security considerations aside, I would rather have the guard rails afforded me by a normal user account for things that don&#x27;t have some specific reason to be privileged.

Technically, the main point for sudo is allowing non-root users access to a limited set of commands. That said, if you needed this, you should be using an actual MAC system.

The argument-via-AWS probably indicts <i>sudo</i>, but it threatens in addition to indict any sort of command line access to production hosts. Why are you fixing your server with a typed command? Why not just kill it and spin up another?

On my severs I often use “sudo -s“ in a separate tmux window. I&#x27;ve changed my PS1 to give me a red prompt for root. Over the years I never had a situation where I accidentally did something stupid as root.

The only thing I agreed was: &quot;If you manage a server, use root&quot;. sudo is a good way to let unprivileged users to execute a restricted set of commands, it&#x27;s easy to learn and setup.

===8&lt;== Update 2016-07-09 05:58 UTC<p>Just to be clear: Please note it’s filed under the “Rant” category. The post has some valid points but don’t take it too seriously. Use your best judgment to decide which parts of the above apply to your situation. ===8&lt;===

This seems relevant: <a href="http:&#x2F;&#x2F;www.garyshood.com&#x2F;root&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.garyshood.com&#x2F;root&#x2F;</a>