What are some examples of these "several distros" that set it by default? Of the major ones I'm willing to use in production (Debian, Ubuntu, RHEL and derivs, SuSE, hesitantly Arch), none offer NOPASSWD sudo to users marked as administrative in each distro's normal way. (i.e. various group memberships)
Comments
If you are logged in as root, you can do anything.
If you are logged in as a sudo user, provided allowing only an ssh key, can you can't do anything unless:
- you know the password
- you trick the user into doing the action for you (E.G: a line in the bashrc)
The first one will slow down the attaker, the second one may trigger the user BS detector.
This assumes one isn't using password-less sudo (NOPASSWD), which several distros do set by default and many users change to it for convenience.
What are some examples of these "several distros" that set it by default? Of the major ones I'm willing to use in production (Debian, Ubuntu, RHEL and derivs, SuSE, hesitantly Arch), none offer NOPASSWD sudo to users marked as administrative in each distro's normal way. (i.e. various group memberships)
NOPASSWD is poor hygiene.
Raspbian doesn't require a password when using sudo.
GCP sets it in Debian, apparently.
Amazon Linux
Also Ubuntu in Azure.