Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 6 ■ SECURING YOUR SYSTEMSYou can run one of these options at a time (in which case, try “single crack” mode first) or run all ofthem consecutively with this:john /tmp/password.dbTo show the results, use this:john --show /tmp/password.dbYou can then insist on a password change if any of your users have failed the test!■ Note Also remember that you can limit cracking attempts through measures such as locking out specific IPaddresses after multiple failed ssh attempts (see recipe 6-13) or limiting the number of times a user can get apassword wrong when logging on.6-11. Limiting sudoThe /etc/sudoers file sets up who can use sudo (that is, who can masquerade as root) and under whatcircumstances. The basic usage is just to permit a user to have all the privileges that root does, but youcan also do far more than that.It’s best to edit /etc/sudoers (you’ll need to be root to do this or use sudo with a username that’salready in the file) with the command visudo, because that will check that the file can be parsed correctlybefore it’s saved.■ Note visudo won’t necessarily use vi as the editor; it’ll use whatever is the default editor for the user you’relogged in as.The most basic sudoers line would be to permit a particular user to do absolutely anything withsudo:jkempALL = (ALL) ALLALL is an automatically defined alias, which means what it says on the tin. This is the format of thisline:user Host = (Runas) commanduser is the username that you’re running sudo from. Host is the machine that you’re running sudo onor trying to access. Runas is the user that you want to use sudo to log in as. command is the command youwant to run.148Download at WoweBook.Com