From c49234b5a846853ff07ec6994417fd0a2a387302 Mon Sep 17 00:00:00 2001 From: daobrien Date: Mon, 1 Feb 2021 15:08:36 +1000 Subject: [PATCH 1/2] Addresses #222 Recommendations for using sudo. --- en-US/Design.xml | 86 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 85 insertions(+), 1 deletion(-) diff --git a/en-US/Design.xml b/en-US/Design.xml index 59eee63..dff5eaf 100644 --- a/en-US/Design.xml +++ b/en-US/Design.xml @@ -310,7 +310,7 @@ $ vi myFile.txt You can also indent the second and subsequent lines of such commands to assist in clarity and readability if required. You can use this option for either of the two designs mentioned above. - + Wrapping Long Commands with Continuation Characters @@ -338,6 +338,7 @@ $ vi myFile.txt +
Referring to Replaceable Paths @@ -371,6 +372,89 @@ $ vi myFile.txt
+
Using Escalated Privileges Correctly + + + This section is aimed primarily at Red Hat Training course material, but the principles and guidelines apply equally in any environment. + + + + The term escalated privileges refers to changing to a user whose privileges allow operations that a normal user cannot access. + It also refers to temporarily changing the privileges of the current user to perfom those operations without actually changing user accounts. + + Classroom Exceptions + + Although security is important, it is more important to not have unnecessary classroom security distract from the immediate topic being taught. + + +
General Recommendations + + + These are recommendations, not rules. + As with most things, consistency is important. + Do not swap between different approaches without reason. + Choose which approach works best for your situation and use it consistently. + + + + + + In all cases, use the minimum privilege level required to achieve the task. + + + + + In exercises, use sudo and sudo -i and set this up to work throughout all relevant systems in the classroom. + Do not use su - without good cause. + + + + + When there is a scattered minority of privileged commands in a mostly unprivileged exercise, use sudo on a per-command basis. + + + + + When the exercise is majority privileged, or has a significant number of privileged commands, use sudo -i either at the beginning of the exercise, or at an appropriate step where the privileged commands begin. + + + + + In the narrative, do not show the use of su or sudo, but always show privileged commands with the correct prompt. + See for information about command prompts. + + + +
+
Exceptions + + Some courses are specifically designed to teach sudo and its variations, the use of the related files, such as /etc/sudoers and so on. + For these courses, use the required variation for the topic being taught. + +
Ansible Courses + + + + Ansible courses typically use a devops user with passwordless sudo ALL=ALL(ALL) access on managed nodes to enable the use of become without a become password as root to do anything. + + + + + As much as possible, leave the system-wide default as become: false or become: no and if a single task needs privileges, set become: true or become: yes on that task. + + + + + If most tasks in a play require escalated privileges, set the entire play to become: true or become: yes and possibly selectively set individual tasks to become: false or become: no. + + + +
+
+ + +
+
Describing How to View and Edit Files From 1f39904068013d3f0818afc493c005081dc527d8 Mon Sep 17 00:00:00 2001 From: David O'Brien Date: Mon, 1 Feb 2021 23:03:55 +1000 Subject: [PATCH 2/2] Update en-US/Design.xml Co-authored-by: mweetman-redhat --- en-US/Design.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/en-US/Design.xml b/en-US/Design.xml index dff5eaf..9893766 100644 --- a/en-US/Design.xml +++ b/en-US/Design.xml @@ -435,7 +435,7 @@ $ vi myFile.txt - Ansible courses typically use a devops user with passwordless sudo ALL=ALL(ALL) access on managed nodes to enable the use of become without a become password as root to do anything. + Ansible courses typically use a devops user with passwordless sudo access (devops ALL=(ALL) NOPASSWD: ALL) on managed nodes to enable the use of become without a become password as root to do anything.