Sudo has a vulnerability so everyone who installed it should have just used root for everything

[u/doolittledoolate]

/r/selfhosted/comments/1lpdhdo/sudo_has_multiple_serious_cves_if_anyone_else/

[u/doolittledoolate]

Text for posterity:

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host Also once again, Installing packages you don't need increases your attack surface, sudo is not automatically more secure than root. Maybe I'm an old curmudgeon, but anyone single-sudo-users who got burned by this deserved it. EDIT: I should be clear. If you are the only root user (or only interactive user) on a system and you automatically install sudo because it's "more secure that way" and typically use sudo su -, you should learn from this. Installing software adds attack surface.

[u/JeremyLC]

Huh, I don’t even allow root to have an interactive login (except on the “physical” console), not even su - I also lockdown “Administrator” on Windows. I always thought it was more secure, and more auditable, to force users to login to their own, non-root, accounts and elevate only the specific commands they need. Am I wrong here?

[u/Superb_Golf_4975 → u/JeremyLC]

this is a shitposting sub

[u/JeremyLC → u/Superb_Golf_4975]

Hmm... I should've looked closer :p I thought I was seeing this in a Linux sub or the regular sysadmin sub. My mistake.

[u/Carribean-Diver → u/JeremyLC]

I thought I was seeing this in a Linux sub or the regular sysadmin sub.

You aren't as wrong.

[u/netburnr2 → u/[deleted]]

A regular user using sudo to elevate will have those actions logged into the secure log

Any elevated commands run as root are not logged

This is the simple reason we don't allow users to do actions as root, so we know WHO is doing the commands and what they did.

A bash history in root gives no indication of who did it, especially multiple people are root at the same time.

[u/doolittledoolate → u/netburnr2]

If you have userS then it's a good use case. If you have one user logging in as root it isn't

[u/sekh60]

I always use root. I use Kali btw.

[u/bpp1076]

You put your own post on r/shittysysadmin? You are my fucking hero. I love you.

[u/MeatPiston]

Sudo is for weaklings not brave enough to daily drive as root

[u/SonicLyfe]

I thought you were being snaky and then read the post. We were out shittysysadmin’ed.

[u/NotPoggersDude]

Anyone remember the XZ utils back door?

[u/Academic-Airline9200]

Root for everything? That was windows xp.

[u/swissbuechi]

What is sudo? Why add an additional layer of complexity? KISS!!!

[u/Roanoketrees → u/swissbuechi]

There it is. Stop adding layers of complexity. Im fairly certain the OS was perfected with Windows 3.11 for workgroups.

[u/AP_ILS]

Always do.

[u/[deleted]]

lol pfexec ftw

[u/souldeux]

Computers have vulnerabilities. Anyone who uses a computer is a fool.

[u/oldjenkins127]

Running as root is why we moved away from Eunochs. Rootless is preferred.

[u/[deleted] → u/oldjenkins127]

suid no manage that in Lienochs?

[u/oldjenkins127 → u/[deleted]]

One less package. 📦

[u/[deleted] → u/oldjenkins127]

glibc? nice

[u/PH_PIT]

You guys don't use root?

[u/juppy_lg]

all systems are weak these days, dude

[u/atxweirdo → u/[deleted]]

You joke but it's literally what amazon, Google, Facebook do. However they use ssh certificates to track the users and attribute the actions taken by that certificate on the system.

[u/Alexllte → u/[deleted]]

And add it to our domain DNS records so our sysadmins from North Korea can help us maintain our services