Replacing sudo.

Excalibur · 2022-09-02 14:07:42

OpenBSD has replaced sudo from its default install with doas. This utility is available in Devuan's package repositories. Once installed you create an /etc/doas.conf file with the needed commands you wish to run as root. An example is given below:-

permit nopass username as root cmd /sbin/shutdown

To run the command just type, doas /sbin/shutdown -r now.

Further examples can be found at the bottom of the doas.conf man page.

So, to install doas do the following: aptitude purge sudo ; aptitude install doas (use your preferred package manager)

There may be a caveat in using doas, some heavyweight desktop environments may have a dependency on sudo, so check this out before you try doas. I think you will find doas has a cleaner syntax than sudo and I have found it to be more flexible for my needs.

Camtaf · 2022-09-02 17:06:59

It was introduced because a lot of admins had problems configuring sudo properly, & it has a lot less options, which makes it easier.

They introduced doas just after I finally got around to buying Sudo Mastery, just my luck.

Head_on_a_Stick · 2022-09-02 17:15:53

The creator of doas explains their reasons here:

https://flak.tedunangst.com/post/doas

chris2be8 · 2022-09-03 16:03:09

Excalibur wrote:

So, to install doas do the following: aptitude purge sudo ; aptitude install doas (use your preferred package manager)

Or better:
aptitude install doas
Check doas works and does everything you need!
aptitude purge sudo
Now check if everything still works. Eg does the menu option to shut down the system need sudo?

I've spend too many years installing software to risk cutting myself off.

brocashelm · 2022-09-03 18:42:05

Head_on_a_Stick wrote:

The creator of doas explains their reasons here:
https://flak.tedunangst.com/post/doas

I've been listening to some of Ted Unangst's talks. He's very thorough about his approach to improving code.

Anyway, I've been playing around with doas and actively considering installing OpenBSD on the side. I like the more minimalist, no-hands-held environment.

Last edited by brocashelm (2022-09-03 18:42:26)

Camtaf · 2022-09-04 09:40:27

As far as regular desktop users, & small networks go, doas would be a better option for most distros.

delgado · 2022-09-04 12:45:33

Hm, how would the following look in doas style?
(Capt. Obviuos does not want to compile as root)

$ ./configure
$ make
$ sudo make install

Head_on_a_Stick · 2022-09-04 14:26:51

^

./configure
make
doas make install

Or add this to your shell initialisation file (eg, ~/.bashrc):

alias sudo='/usr/bin/doas'

Then just carry on using sudo as you always have done.

Devarch · 2022-10-03 17:57:53

I still need password with doas inspite of:

permit username as root
permit nopass username as root

in /etc/doas.conf

Strange

Camtaf · 2022-10-04 08:47:07

It's not meant to allow all encompassing usage, that's what su is for.

Head_on_a_Stick · 2022-10-04 15:40:14

Devarch wrote:

I still need password with doas inspite of

Sorry to ask but you did replace username with the actual username, right?

That syntax works for me with the Debian doas package provided the actual username is supplied.

Devarch · 2022-10-04 21:33:57

Head_on_a_Stick wrote:

Devarch wrote:
I still need password with doas inspite of
Sorry to ask but you did replace username with the actual username, right?
That syntax works for me with the Debian doas package provided the actual username is supplied.

yes.

I've discovered that if this line is present
permit persist keepenv setenv { XAUTHORITY=/home/username/.Xauthority DISPLAY=:0.0 LANG LC_ALL } :username

than this problem is present.

Surprisingly, if this line is removed I do not need to tap password.

But without this line I can not use geany or other staff as root.

Head_on_a_Stick · 2022-10-05 05:06:47

If you want to run a graphical text editor as root then either use one that takes advantage of the GVFS admin:// backend:

gedit admin:///full/path/to/file

Or stick with sudo:

SUDO_EDITOR=geany sudoedit /path/to/file

Set $SUDO_EDITOR in /etc/environment to make it permanent then just use plain sudoedit.

Running the entire GUI editor as root is simply ridiculous. Don't do it.

Devarch · 2022-10-05 19:18:00

Head_on_a_Stick, hhank you for this hint.

What is wrong with using XAUTHORITY? Almost every linux distribution lets run editor as root? I use it to edit system files. Is there some security problem?

Last edited by Devarch (2022-10-05 19:18:23)

Head_on_a_Stick · 2022-10-05 19:34:30

See https://en.wikipedia.org/wiki/Principle … _privilege — what's the point of running the graphical interface as root if you only need to use elevated priviledges to save the modified file? That's what sudoedit & admin:// do.

Devarch wrote:

Almost every linux distribution lets run editor as root?

Almost every Linux distribution expressly advises against running editor GUIs as root. That's why sudoedit & admin:// exist. The latter is the default for GNOME and can also be used in the file manager so that can be operated without having to run the GUI itself as root.

EDIT: just for the record this works fine in my sway (Wayland) desktop:

doas mousepad /etc/fstab

I didn't think that was supposed to be possible

Last edited by Head_on_a_Stick (2022-10-05 19:37:10)

dpkg · 2023-09-11 20:41:25

Devarch wrote:

Surprisingly, if this line is removed I do not need to tap password.

It is because:

     The last matching rule determines the action taken.  If no rule matches, the ac-
     tion is denied.

https://man.openbsd.org/doas.conf#DESCRIPTION

Devarch wrote:

What is wrong with using XAUTHORITY?

Nothing, but you should have only one line matching the same username.

permit nopass keepenv setenv { XAUTHORITY=/home/username/.Xauthority DISPLAY=:0.0 LANG LC_ALL } username as root

czeekaj · 2023-09-17 02:47:47

There is also sudo -i to just pretty much login as root.

to make it request password everytime you might need to set alias in .bashrc when sudo is invoked.
Although I am unsure how to block sudo -i using an alias.

czeekaj · 2023-10-31 17:58:35

https://sup.dyne.org/

This is apparently a replacement option

yeti · 2023-10-31 19:54:33

sup? Compile-time configuration smells too much like those suck**ss tools. Definitely not my taste.

For a while now doas has got persist added on Linux too, so I see no reason any more not to use it.

The officially official Devuan Forum!

#1 2022-09-02 14:07:42

Replacing sudo.

#2 2022-09-02 17:06:59

Re: Replacing sudo.

#3 2022-09-02 17:15:53

Re: Replacing sudo.

#4 2022-09-03 16:03:09

Re: Replacing sudo.

#5 2022-09-03 18:42:05

Re: Replacing sudo.

#6 2022-09-04 09:40:27

Re: Replacing sudo.

#7 2022-09-04 12:45:33

Re: Replacing sudo.

#8 2022-09-04 14:26:51

Re: Replacing sudo.

#9 2022-10-03 17:57:53

Re: Replacing sudo.

#10 2022-10-04 08:47:07

Re: Replacing sudo.

#11 2022-10-04 15:40:14

Re: Replacing sudo.

#12 2022-10-04 21:33:57

Re: Replacing sudo.

#13 2022-10-05 05:06:47

Re: Replacing sudo.

#14 2022-10-05 19:18:00

Re: Replacing sudo.

#15 2022-10-05 19:34:30

Re: Replacing sudo.

#16 2023-09-11 20:41:25

Re: Replacing sudo.

#17 2023-09-17 02:47:47

Re: Replacing sudo.

#18 2023-10-31 17:58:35

Re: Replacing sudo.

#19 2023-10-31 19:54:33

Re: Replacing sudo.

Board footer