Raspberry Pi OS ends open-door policy for sudo

The latest version of Raspberry Pi OS now requires a password for sudo by default. The change affects only new installations - existing setups are untouched. Using the sudo prefix to run a command with administrator privileges will now prompt for a password; enter it wrong, and the command is refused. Previously, any user …

[may_i]

The obviously correct decision

The first thing I do when I set up a new Pi is to require a password for sudo.

From the point of view of teaching hobbyists good habits, this should always have been the default behaviour.

[Charlie Clark]

Re: The obviously correct decision

Depends on what you're doing with the system and what user groups you have – I think it's a bit OTT for our Pikaraoke machine…

[may_i]

Re: The obviously correct decision

Of course. If you need to relax or modify security then it is your choice.

However, insecure by default is bad policy.

[Tron]

Re: The obviously correct decision

No age gating yet, Tut tut. There will be a few US states that will have a problem with that soon.

[bombastic bob]

Re: The obviously correct decision

Plenty of patches and instructions on how to bypass the age nonsense will be available. I should make one and call it "I fart in your general direction, Cali-Fornicate-You".

[and also include accurate information on sparrows]

[Anonymous Coward]

Re: The obviously correct decision

If it is connected to networks with other devices on the same segment, it is fundamental security good practice for defaults to be secure. Doubly so if anything including itself connect to other segments and immeasurably so if any of it is connected to the Internet. Of course, some fruit thinks it needs to hang low so it gets eaten to reproduce and here we are.

[NoneSuch]

Re: The obviously correct decision

"Depends on what you're doing with the system and what user groups you have"

If you have no decent security, it will not be your system for long.

[katrinab]

Re: The obviously correct decision

Unless of course it is air-gapped, which for a lot of cases, it may well be.

[Doctor Syntax]

Re: The obviously correct decision

Even better would be to encourage hobbyists to change the default root password and use su to do admin tasks so that there are two different passwords required to get root privilege. At best sudo is a triumph of convenience over security.

[FIA]

Re: The obviously correct decision

At best sudo is a triumph of convenience over security.

Isn't it a bit more complex than that. The real issue is a god like 'root' user that can do anything.

The advantage with sudo is you don't need to disseminate the root password and you can have multiple people allowed to be root without them having to know the root password, or each others either.

(Now sure... you're godlike root powers mean you can change it... but that's an issue with godlike root again...)

[really_adf]

Re: The obviously correct decision

"The real issue is a god like 'root' user that can do anything."

In the end you always need that, but sudo can be configured to offer less to a given user. Whether or not you do that is, as with requiring a password or not, a security/convenience trade-off.

[Roland6]

Re: The obviously correct decision

>"The real issue is a god like 'root' user that can do anything."

In the end you always need that

The real problem is most people’s understanding of security roles. Both Unix and Windows have comparatively poor securtty compared to say IBM’s ancient mainframe implementation of RACF….

[CoyoteDen]

Re: The obviously correct decision

Not to mention you can set up /etc/sudoers to only allow a user or group to run specific commands as root or another user.

This is what sudo was really meant to provide: granular privilege escalation vs. sharing the root password or SUID permission.

[DaDragon]

Re: The obviously correct decision

Yeah, not confident Doctor Syntax knows what they're talking about here. A root password no one gets and user admin passwords for ad hoc elevation is pretty industry standard. And if one person is in control of both passwords, having two doesn't really advance security. Especially since if you access root, you access true root, and that is not more secure. It's less. A super user can have more flexible permissions, and certain things you don't want to allow them to do can be blocked, so that even if that account is compromised you can have that superuser blacklisted from certain functions. But if one person controls both passwords and they are compromised, then the attacker now has true root and your whole system is immediately lost.

[druck]

Re: The obviously correct decision

Just how many Dr Syntax's do you think there are?

[Doctor Syntax]

Re: The obviously correct decision

Doctor Syntax has been administering various Unix systems from Edition 7 days until he retired. In particular he may know more than DaDragon because he remembers how privileges could be split up before sudo in a way that didn't fail a basic principle.

In view of discussion further down thread he also knows that su did not mean for "superuser". It was an abbreviation of "substitute user". su lpadmin meant that the user could run a shell as lpadmin and needed lpadmin's password - an additional key to gain additional privilege which is the better way to do it.

[Anonymous Coward]

Re: The obviously correct decision

Hate yo say it, but if you think passwords are a solution to anything it's great you're retired.

And I've been administering *nix since Sladkware 1.0....

[Phil O'Sophical]

Re: The obviously correct decision

you can have multiple people allowed to be root without them having to know the root password, or each others either.

And the auditing built-in to sudo means that you know exactly which user screwed up.

[botfap]

Re: The obviously correct decision

The audit logs are great, right up to the point that the user with sudo access realises they can also delete or alter the audit logs using sudo...

[CrazyOldCatMan]

Re: The obviously correct decision

And the auditing built-in to sudo means that you know exactly which user screwed up

Assuming you have rsyslog set up and a non-blank system to examine..

(Yes, yes, you *might* be able to recover a drive that's been "rm -rf"'d but it's expensive and not a lot of data recovery sites can handle anything linux that isn't ext-3..)

[Gary Stewart]

Re: The obviously correct decision

"The advantage with sudo is you don't need to disseminate the root password and you can have multiple people allowed to be root without them having to know the root password, or each others either."

Yes that was exactly what sudo was designed to do. However every distro I've used, including PiOS give a sudoer those same god like powers ( ALL=(ALL) ALL) which is explicitly not what it was designed for. Of course that power is generally needed if you use sudo to replace su but in doing so you completely negate any security advantages with sudo by making it easier to gain those powers en mass because way too many users have really bad passwords.

[spuck]

Re: The obviously correct decision

Yes, but you don't need to allow all users to run sudo.

[Gary Stewart]

Re: The obviously correct decision

Yes, but you don't need to allow any users to run as root, except for the admin. Assuming we are talking about multi-user(?) Raspberry Pis which I don't doubt exist but given that the complaint I hear about most even with the Pi 5 (except for price, thanks AI) is their lack of performance I don't see that being much of a thing.

[lordminty]

Re: The obviously correct decision

"the complaint I hear about most even with the Pi 5 (except for price, thanks AI) is their lack of performance"

What?

A Pi 5 with a PCIe hat and an NVMe SSD has more iops than an enterprise class Exadata storage server from 2010.

And CPU wise it has comparable performance to an intel Xeon Gold 6126 from 2018. Those were commonly fitted in Dell PowerEdge Gen14 (e.g., R640, R740, T640) and HPE ProLiant Gen10 (e.g., DL380, ML350) servers.

Hardly a "lack of performance".

[CrazyOldCatMan]

Re: The obviously correct decision

And CPU wise it has comparable performance to an intel Xeon Gold 6126 from 2018. Those were commonly fitted in Dell PowerEdge Gen14 (e.g., R640, R740, T640)

[Pats R720 consolingly]

"Don't worry - that upstart Rpi5 glowering down at you won't ever have more RAM or disk space.."

(Or two CPUs. To go with the 128GB RAM and the 27TB of disk space..)

[Forbidden.Era]

Re: The obviously correct decision

Only 128? Pff my r820 has 758! And that feels light, technically takes double.

[lordminty]

Re: The obviously correct decision

Remind me how much electricity your server consumes?

The worst a Pi 5 can use is 25W.

[Forbidden.Era]

Re: The obviously correct decision

Clu-wise I think you're on crack. A quick google shows benchmarks and LLm both believe it's at least a w0x performance gap for multicolor and double for single core.

Still not bad for something that fits in your pocket but yeah no.. my server, with a much older xeon, is waay faster than my nvme pi5.

Even the nvme storage tends to top out under 800mb/s which my servers rust array easily beats.

But the server pulls hundreds of watts and weighs like 40kg. The pi laughs at a kg and maybe uses 5.

[spuck]

Re: The obviously correct decision

The two biggest problems (for me) that sudo vs. root access solves are:

1) Controlling knowledge of the root password. If there is a root account that can be used, I can't guarantee who knows and who doesn't know the password. You can prove that Alice knows it by asking her to write it down or type it, but you can't prove that Bob doesn't know it in any way. If Charlie knows it and leaves the group, then it must be changed and re-communicated to the remaining staff.

2) Non-repudiation. If "root" did something on the system, I can log that it happened but I can't prove who "root" was at the time it happened.

But then again, this is for me, and these are not problems I'd worry about on my RaspPi in a non-critical role.

Your point about the attack surface expanding by multiple user accounts having access to sudo, if those user accounts have bad passwords, is a good one.

[Doctor Syntax]

Re: The obviously correct decision

"Isn't it a bit more complex than that. The real issue is a god like 'root' user that can do anything."

It is more complex than that. Once upon a time in Unix there were specific user IDs with specific powers. You wan somebody to administer print queues? Give them the lpadmin login. They can use it to administer print queues and nothing more. When I started using Unix there was a user ID bin who owned any system executables that didn't have to be suid to a specific user. The user with the bin password could update software.

It was never as well implemented as it might be, probably because in practice there might only be one administrator to do everything or else all the administrative group needed to do everything. It was a right pain, for instance, if the DBA needed to go cap - or paperwork - in hand to somebody else to get more disk allocated. And I don't recall there being a specific user for password resets or user creation although that might be aged memory.

We got, therefore, to the situation where admins got the root password and the alternative ways of doing things were forgotten so that when anybody got agitated about this sudo got invented. And sudo has one big disadvantage. It fails Saltzer and Shroeder's separation of privileges principle:

"Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key."

It means that instead of requiring two separate passwords to get from a login prompt to executing something that requires elevated privilege it just needs the one password applied twice. If the sudo user's password gets leaked then whoever acquired needs nothing more and as the usual case is, as before, there's just ordinary user and root privileges, it's root that's leaked.

Add to that the fact that you've enlarged the attack surface - and ISTR reports of a bug in sudo - you've introduced a security hole by trying to plug one.

My view is that in most cases sudo makes a system less secure by its presence.

[MarkMac]

Re: The obviously correct decision

Weirdly, the first thing i do when i set up a new Pi, or indeed any Linux system, is enable controlled passwordless sudo for specific users and commands.

Obviously, utterly uncontrolled passwordless sudo is foolish.

However, good security policy places barriers in the way of those who should not, and removes them from those who should. If you make life harder for those who should, then they vote with their feet or they put in place hacks, workarounds and mitigations that ultimately weaken your security. The classic example is making passwords too complex, so that people have to write them down on post-it notes.

And its all moot anyway if someone has physical access to the device, which is the case with most consumer hardware.

[cyberdemon]

Re: The obviously correct decision

I agree of course, but I never use sudo. I use

su -

if I need root access

The dash was added for some bizarre reason in order to use root's environment, but it's just as quick as sudo if sudo requires a password

So, why use sudo at all? I get that it is sort of useful for semi-managed environments where you trust the users but not necessarily their level of training.. But for a raspberry pi? Just use su

[bombastic bob]

Re: The obviously correct decision

Normally I just limit what sudo can do as best as i can in the sudoers.d directory, and also disable unrestricted sudo (without password) unless there's a need for it [like an embedded system with no ssh access unless you EXPLICITLY enable it with an admin command on the control screen or whatever]. Even so, limiting what sudo can do is a "best practices" scenario and ought to be applied by default as well, forcing users to enable a less restrictive security model and only if they need it.

If the 'promiscuous user' name 'pi' (and initial password) were NOT so well known it would be slightly LESS of a problem...

[Colonel Mad]

Superuser do

[Yet Another Anonymous coward]

Scooby scooby doo

[Doctor Syntax]

Scooby dooby do

[Yet Another Anonymous coward]

sudo where --are -you

[Anonymous Coward]

We need to run as root now.

[The commentard formerly known as Mister_C]

Exchanging glances

for the Sinatra fans

[Anonymous Coward]

I had always originally assumed that "sudo" was intentionally a pun on "pseudo" in the tradition of many old-time evolving program names (elm, pine, alpine, etc), as in "to pretend to become a different user", and have continued to stick with that interpretation and pronunciation. Other interpretations are of course acceptable: TMTOWTDI!

[Yet Another Anonymous coward]

Makes sense, after all CS is just a sudo science.

[Joe Gurman]

Think of the children....

....or at least the ones too lazy to get up from a chair and make their own sandwiches.

https://xkcd.com/149

[TVU]

Purely by coincidence, Sudo is also Latin for I sweat so now we know.

[JamesTGrant]

nearly!

[DrXym]

Just add it to Raspberru Pi Imager

The imager software that burns the OS onto a microsd asks for the hostname, username & password, timezone, wifi, ssh on/off etc. already has a "enable passwordless sudo" that warns the user if they disable the option but otherwise lets them do what they like.

[Steve Graham]

I have 3 headless Pi units doing things around the house. I disabled the policy of letting the non-root user execute all commands as root, and enabled a couple of convenience ones. Although if someone is on my home network and logging in to them, privilege escalation is probably the least of my worries.

[Bebu sa Ware]

Might make Pi owners read the sudoers(5) man page.

Pretty easily to reinstate the original behaviour or have passwordless sudo for a restricted set of commands.

Perhaps also not obvious that sudo can run commands as another non-root user.

You can also ssh-agent forwarding to auth with sudo which is very convenient if not terribly secure.

Certificates (SSH ones) are apparently "the way" to do this stuff… with a dash of 2FA. Unfortunately there were never enough hours in the day…

Anything is better than the suid root wrappers that just exec a shell that I have encountered over the years.

Michael W Lucas' "Sudo Mastery" at 200 pages probably covers more of the subject than most need or want.

[Anonymous Coward]

Obligatory

XKCD

[Flocke Kroes]

Re: Obligatory

Instead of "OK" the default response is now "What is your password?"

[David 132]

Re: Obligatory

the default response is now "What is your password?"

"Please"?

[Cheshire Cat]

Re: Obligatory

This incident will be reported

[khjohansen]

Re: Obligatory

This incident will be reported logged!

[Anonymous Coward]

Passwordless sudo ?

Well today I learned.

So basically it's how Windows elevated privileges work. No password needed to perform admin actions.

[IGotOut]

Re: Passwordless sudo ?

Depends on how you've set it up. A regular use will need to enter Admin credentials.

[Doctor Syntax]

Re: Passwordless sudo ?

A regular user in the sudoers list needs only their regular password. In effect they're using the admin password all the time.

[Kenny Millar]

Pi who?

Lets be honest. No hobbyist can afford a Raspberry Pi SBC anymore anyway.

[werdsmith]

Re: Pi who?

If we are being honest, 1GB Pi4 is still the $35 SBC as promised in 2012 and the Pi5 1GB is just $10 more.

[JamesTGrant]

I bought a Pi Zero 2 W last week for… £13.99 (a fully functioning quad core computer for the cost of 2 pints of beer at a London pub). Bonkers.

[Mishak]

Bonkers

Indeed - more like 3.5 pints where I live.

[Cheshire Cat]

yes, your beer is way overpriced (laughs in Kiwi)

[CrazyOldCatMan]

yes, your beer is way overpriced (laughs in Kiwi)

The keyword is "London".

Round these parts, it's more reasonable. Not that I drink it if proper [1] cider is available..

[1] Cloudy, unidentifed bits floating in it, smells like a badger has peed iin it.. that sort of cider.

[lordminty]

That's £13.99 for a computer half the size of a credit card that can emulate a 1990s IBM mainframe that cost over £6million.

Has anyone other technology ever provided that level of cost reduction?

A Pi is not expensive!

[Anonymous Coward]

I've been setting up sudo without a password on my PCI-DSS production systems for more than a decade, and so far, that hasn't tickled the auditors. There are already layers of authentications before getting to sudo, and I've never been convinced that adding one there was doing anything for security. The users have the right to run a command as root or they don't. Is there something different with Raspberries that anybody with a user account automatically has the right to sudo any command and get privileged?

[mIVQU#~(p,]

passwordless sudo is fine for pi - the user still needs to be in /etc/sudoers

[PaulHayes]

Good. I've always thought it was very poor practise of the Pi foundation to have their mostly supported OS include such bad practises by default. Using default passwords is a huge problem too. Sure people can change it all but it just encourages bad practises and many Pi users will not know any better, it's a device originally aimed at education.

[James Hughes 1]

Ltd, not Foundation.

[lordminty]

Raspberry Pi OS hasn't had a "default password" or indeed a default user since at least 2022.

[Anonymous Coward]

Another obligatory xkcd

https://xkcd.com/1200/

[Paul Hovnanian]

So ...

... someone at RPi finally RTFM for sudo.

Not that their delivery policy for new systems is a bad idea. Newbies could spend weeks/months learning all the ins and outs of an unfamiliar system. Only to discover that it wad pwnd the first day they plugged it in. Lock it all down and have the users learn how to relax the restrictions.