mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-02-03 01:50:04 -05:00
Move core user docs back to appropriate sections; fix VM sudo title
Minor spelling fix in VM sudo title and headings. Requested by: https://github.com/QubesOS/qubes-doc/pull/823#issuecomment-496316322 Related to: QubesOS/qubes-issues#4693
This commit is contained in:
parent
04efa3c40d
commit
075c6df169
2
doc.md
2
doc.md
@ -87,7 +87,7 @@ Core documentation for Qubes users.
|
|||||||
|
|
||||||
* [Qubes Firewall](/doc/firewall/)
|
* [Qubes Firewall](/doc/firewall/)
|
||||||
* [Understanding and Preventing Data Leaks](/doc/data-leaks/)
|
* [Understanding and Preventing Data Leaks](/doc/data-leaks/)
|
||||||
* [Password-less Root Access in VMs](/doc/vm-sudo/)
|
* [Passwordless Root Access in VMs](/doc/vm-sudo/)
|
||||||
* [Device Handling Security](/doc/device-handling-security/)
|
* [Device Handling Security](/doc/device-handling-security/)
|
||||||
* [Anti Evil Maid](/doc/anti-evil-maid/)
|
* [Anti Evil Maid](/doc/anti-evil-maid/)
|
||||||
* [Split GPG](/doc/split-gpg/)
|
* [Split GPG](/doc/split-gpg/)
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
layout: doc
|
layout: doc
|
||||||
title: VM Sudo
|
title: Passwordless Root Access in VMs
|
||||||
permalink: /doc/vm-sudo/
|
permalink: /doc/vm-sudo/
|
||||||
redirect_from:
|
redirect_from:
|
||||||
- /en/doc/vm-sudo/
|
- /en/doc/vm-sudo/
|
||||||
@ -8,7 +8,7 @@ redirect_from:
|
|||||||
- /wiki/VMSudo/
|
- /wiki/VMSudo/
|
||||||
---
|
---
|
||||||
|
|
||||||
Password-less root access in VM
|
Passwordless Root Access in VMs
|
||||||
===============================
|
===============================
|
||||||
|
|
||||||
Background ([/etc/sudoers.d/qubes](https://github.com/QubesOS/qubes-core-agent-linux/blob/master/misc/qubes.sudoers) in VM):
|
Background ([/etc/sudoers.d/qubes](https://github.com/QubesOS/qubes-core-agent-linux/blob/master/misc/qubes.sudoers) in VM):
|
||||||
@ -92,8 +92,8 @@ Below is a complete list of configuration made according to the above statement,
|
|||||||
- used for access to 'root' account from text console (xl console) - the only way to access the VM when GUI isn't working
|
- used for access to 'root' account from text console (xl console) - the only way to access the VM when GUI isn't working
|
||||||
- can be used for easy 'su -' from user to root
|
- can be used for easy 'su -' from user to root
|
||||||
|
|
||||||
Replacing password-less root access with Dom0 user prompt
|
Replacing passwordless root access with Dom0 user prompt
|
||||||
---------------------------------------------------------
|
--------------------------------------------------------
|
||||||
|
|
||||||
While ITL supports the statement above, some Qubes users may wish to enable
|
While ITL supports the statement above, some Qubes users may wish to enable
|
||||||
user/root isolation in VMs anyway. We do not support it in any of our packages,
|
user/root isolation in VMs anyway. We do not support it in any of our packages,
|
||||||
@ -108,7 +108,7 @@ this for extra security.**
|
|||||||
[root@dom0 /]# echo "\$anyvm dom0 ask,default_target=dom0" \
|
[root@dom0 /]# echo "\$anyvm dom0 ask,default_target=dom0" \
|
||||||
>/etc/qubes-rpc/policy/qubes.VMAuth
|
>/etc/qubes-rpc/policy/qubes.VMAuth
|
||||||
|
|
||||||
(Note: any VMs you would like still to have password-less root access (e.g. TemplateVMs) can be specified in the second file with "\<vmname\> dom0 allow")
|
(Note: any VMs you would like still to have passwordless root access (e.g. TemplateVMs) can be specified in the second file with "\<vmname\> dom0 allow")
|
||||||
|
|
||||||
2. Configuring Fedora TemplateVM to prompt Dom0 for any authorization request:
|
2. Configuring Fedora TemplateVM to prompt Dom0 for any authorization request:
|
||||||
- In /etc/pam.d/system-auth, replace all lines beginning with "auth" with these lines:
|
- In /etc/pam.d/system-auth, replace all lines beginning with "auth" with these lines:
|
||||||
@ -154,7 +154,7 @@ this for extra security.**
|
|||||||
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck stop
|
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck stop
|
||||||
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck status
|
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck status
|
||||||
|
|
||||||
Dom0 password-less root access
|
Dom0 passwordless root access
|
||||||
------------------------------
|
-----------------------------
|
||||||
|
|
||||||
There is also password-less user->root access in dom0. As stated in comment in sudo configuration there (different one than VMs one), there is really no point in user/root isolation, because all the user data (and VM management interface) is already accessible from dom0 user level, so there is nothing more to get from dom0 root account.
|
There is also passwordless user->root access in dom0. As stated in comment in sudo configuration there (different one than VMs one), there is really no point in user/root isolation, because all the user data (and VM management interface) is already accessible from dom0 user level, so there is nothing more to get from dom0 root account.
|
Loading…
x
Reference in New Issue
Block a user