August 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1174944] Default sudoers configuration is confusing/error prone
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1174944 http://bugzilla.opensuse.org/show_bug.cgi?id=1174944#c3 --- Comment #3 from Neil Rickert <nwr10cst-oslnx(a)yahoo.com> --- >I want to bring security best practices to the platform from my experience as an enterprise administrator. Then we disagree about security best practices. I was a system administrator for 25 years (mostly on Solaris). And I am disagreeing with you here. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174944] Default sudoers configuration is confusing/error prone
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1174944 http://bugzilla.opensuse.org/show_bug.cgi?id=1174944#c2 --- Comment #2 from William Brown <william.brown(a)suse.com> --- (In reply to Neil Rickert from comment #1) > I mostly disagree with this. > > I have never found "sudo" to be confusing or misleading. I'll note that I > rarely use it. My preference is to use "su" rather than "sudo". If you prefer to us su that's up to you, but sudo is best practice for a large organisation with centralised authentication. > > >This configuration is uncommon and surprising. > > As far as I know, "openSUSE" is using "sudo" as originally intended. > > The idea was that the system administrator would use "su". The intended use > of "sudo" was to provide the ability of selected users to have limited root > access only for running specific commands. > > One of the reasons that I prefer openSUSE to Ubuntu, is that I really > dislike the way at Ubuntu mucked up the adminstrative use of the system and > changed the way "sudo" worked. > > And now you seem to want to Ubuntu-ize openSUSE. No. I want to bring security best practices to the platform from my experience as an enterprise administrator. > > The day that openSUSE becomes Ubuntu will be the day that I go looking for > another distro. > > Yes, many distros now follow the Ubuntu way of doing this. But that's no > reason that openSUSE should do the same. > > >This means the expectation of most people is that the password for sudo *is* the password of the source account (rather than the target account which SUSE configures by default). > > When I use "sudo" (mostly only for testing), it explicitly says that it is > asking for the root password. I don't see how there could be confusion when > the command is quite explicit that it wants the root password (unless > configured otherwise). > > >This is especially risky especially given that we allow root password ssh by default. > > I explicitly disallow that. If you want to make a separate bug report about > "ssh" defaults, I might agree with you on that. > > Perhaps there could be a separate package with Ubuntu-style configuration > for "sudo". People who prefer to do it that way could install that package. I disagree. We need secure-by-default options in the distribution. Most people use defaults, so they must be the best we can possibly make them. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174944] Default sudoers configuration is confusing/error prone
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1174944 http://bugzilla.opensuse.org/show_bug.cgi?id=1174944#c1 Neil Rickert <nwr10cst-oslnx(a)yahoo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nwr10cst-oslnx(a)yahoo.com --- Comment #1 from Neil Rickert <nwr10cst-oslnx(a)yahoo.com> --- I mostly disagree with this. I have never found "sudo" to be confusing or misleading. I'll note that I rarely use it. My preference is to use "su" rather than "sudo". >This configuration is uncommon and surprising. As far as I know, "openSUSE" is using "sudo" as originally intended. The idea was that the system administrator would use "su". The intended use of "sudo" was to provide the ability of selected users to have limited root access only for running specific commands. One of the reasons that I prefer openSUSE to Ubuntu, is that I really dislike the way at Ubuntu mucked up the adminstrative use of the system and changed the way "sudo" worked. And now you seem to want to Ubuntu-ize openSUSE. The day that openSUSE becomes Ubuntu will be the day that I go looking for another distro. Yes, many distros now follow the Ubuntu way of doing this. But that's no reason that openSUSE should do the same. >This means the expectation of most people is that the password for sudo *is* the password of the source account (rather than the target account which SUSE configures by default). When I use "sudo" (mostly only for testing), it explicitly says that it is asking for the root password. I don't see how there could be confusion when the command is quite explicit that it wants the root password (unless configured otherwise). >This is especially risky especially given that we allow root password ssh by default. I explicitly disallow that. If you want to make a separate bug report about "ssh" defaults, I might agree with you on that. Perhaps there could be a separate package with Ubuntu-style configuration for "sudo". People who prefer to do it that way could install that package. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174944] New: Default sudoers configuration is confusing/error prone
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

https://bugzilla.suse.com/show_bug.cgi?id=1174944 Bug ID: 1174944 Summary: Default sudoers configuration is confusing/error prone Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: william.brown(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The defaults sudoers/root configuration on SUSE is confusing/misleading. This is due to the duplication of the first users password to the root account. This configuration critically relies on the following sudoers setting. /etc/sudoers Defaults targetpw # ask for the password of the target user i.e. root ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'! This configuration is uncommon and surprising. This is especially true when viewed in light of how other distributions do not set a root password OR set a seperate root password, and they use the accounts password for sudo rather than targetpw mode. This means the expectation of most people is that the password for sudo *is* the password of the source account (rather than the target account which SUSE configures by default). Due to the fact that the root password and the first user password are duplicated, compromise of the first user password means that the root password may be overlooked and unchanged. This is especially risky especially given that we allow root password ssh by default. This configuration leads to surprises where the user account password is changed, but then sudo "stops working", especially to users coming from other distributions. Targetpw mode also goes against security and IDM best practice as it encourages the use of a shared secret as the root account's password is what is required rather than the password of the source account. This impacts ldap and other IDM integrations as their value proposition is weakened by this setting *unless* the sudoers defaults are altered. It should be the case that the root account should be viewed as a physical-access recovery only account. This means that the password can be recovered through single user mode in the case it is locked, or that in the case it is known it can be used directly. The first-user of a system should be either the local user(ie a laptop) which implies that the first-user is the admin so their password should be used for system administration or that the first user is used as a bootstrap account before enrollment to a configuration management and site IDM system (ie ldap) where again, you want the password of the source account to be used for system administration in sudo. The suggestion I would like to make to improve this is: * Yast2 should request if the first-user account is an administrative role rather than requesting that the first-user account password is duplicated for root. * If the first-user account is an administrative role, setting the root password is optional and locked by default. * If the first-user account is not created as an administrative role, then the root password is a requirement. * Sudo should be installed by default on JeOS/minimal installs. * sshd_config should set "PermitRootLogin no" by default. * sudoers by default should NOT contain the "defaults targetpw" line -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1169166] Leap 15.1 (x86-64) kernel update process causes unnecessary UEFI NVRAM writes -- may lead to premature hardware failure
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

https://bugzilla.suse.com/show_bug.cgi?id=1169166 https://bugzilla.suse.com/show_bug.cgi?id=1169166#c8 Michael Chang <mchang(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |UPSTREAM --- Comment #8 from Michael Chang <mchang(a)suse.com> --- OK. Given this needs to be resolved upstream properly, lets set resolution to it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162080] gnome-tweaks can't be used after changing windows button layout
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

https://bugzilla.suse.com/show_bug.cgi?id=1162080 https://bugzilla.suse.com/show_bug.cgi?id=1162080#c4 --- Comment #4 from Alynx Zhou <alynx.zhou(a)suse.com> --- Send SR to GNOME:Factory: https://build.opensuse.org/request/show/824565 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173972] gcc 'internal compiler error' building Mesa git - softpipe (swrast) for nine
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

https://bugzilla.suse.com/show_bug.cgi?id=1173972 https://bugzilla.suse.com/show_bug.cgi?id=1173972#c12 Dieter Nützel <Dieter(a)nuetzel-hh.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #12 from Dieter Nützel <Dieter(a)nuetzel-hh.de> --- With 10.2.1+git465 at least. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174617] SDDM Theme breeze-openSUSE no longer has a button to display the password typed in
by bugzilla_noreply＠suse.com 06 Aug '20

06 Aug '20

https://bugzilla.suse.com/show_bug.cgi?id=1174617 Lubos Kocman <lubos.kocman(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium CC| |lubos.kocman(a)suse.com Assignee|screening-team-bugs(a)suse.de |fvogt(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174936] New: [doc] 6 Installation of Virtualization Components - Documentation does not mention differences between using Wicked and NetworkManager
by bugzilla_noreply＠suse.com 05 Aug '20

05 Aug '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1174936 Bug ID: 1174936 Summary: [doc] 6 Installation of Virtualization Components - Documentation does not mention differences between using Wicked and NetworkManager Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Documentation Assignee: fs(a)suse.com Reporter: alexander.shchadilov(a)gmail.com QA Contact: fs(a)suse.com Found By: --- Blocker: --- 6 Installation of Virtualization Components: https://doc.opensuse.org/documentation/leap/virtualization/single-html/book… Virtualisation Guide in general is written for systems that have Wicked installed. From Leap 15.1 onwards, NetworkManager is the a default solution for configuring networks on desktops and laptops, while Wicked is still default for server installations. https://news.opensuse.org/2019/05/22/opensuse-community-releases-leap-15-1-… Virtualisation Guide should reflect this change; at least, an introduction of NetworkManager can be mentioned in Chapter 6 "Installation of Virtualization Components", as this is the first place where some practical steps are described and having NetworkManager instead of Wicked will make software behave differently (during steps described in 6.1 "Installing KVM" YaST will skip configuring a network bridge if NetworkManager is used). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174934] New: [doc] 28.2 Enabling or Disabling NetworkManager - Update cases when Network Manager is used by default
by bugzilla_noreply＠suse.com 05 Aug '20

05 Aug '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1174934 Bug ID: 1174934 Summary: [doc] 28.2 Enabling or Disabling NetworkManager - Update cases when Network Manager is used by default Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Documentation Assignee: fs(a)suse.com Reporter: alexander.shchadilov(a)gmail.com QA Contact: fs(a)suse.com Found By: --- Blocker: --- 28.2 Enabling or Disabling NetworkManager: "On laptop computers, NetworkManager is enabled by default." https://doc.opensuse.org/documentation/leap/reference/single-html/book-open… >From Leap 15.1 onwards NetworkManager is used for laptops and desktops, but not servers. https://news.opensuse.org/2019/05/22/opensuse-community-releases-leap-15-1-… -- You are receiving this mail because: You are on the CC list for the bug.

1 0