I'm asking myself whether system security substantially increases when I generate a security policy, i.e. sudoers file which contains one or more Cmnd_Alias definitions that enumerate all executable files prefixed by their SHA-2 checksums under directories such as /usr/bin, /usr/sbin etc. Upon updating the system with packages from a trusted source I would then regenerate the security policy.Any insights whether this is a good or bad idea?
Does it make sudo more secure when indexing all commands by their SHA-2 checksums?
security;sudo;command;checksum;hardening
Sounds like a huge pain to me. I don't think you're actually gaining anything in security, either, as those (a) can only be written as root, so already likely game over if someone can write to them; (b) likely load a bunch of shared libraries, which aren't being checked.The sudoers manpage says the option may be useful in situations where the user invoking sudo has write access to the command or its parent directory. I'm not sure who thought that setup would be a good idea, or for that matter how sudo does a checksum before exec w/o a race condition.I suggest looking into a host-based IDS (e.g., samhain, tripwire, ...) instead. Those will attempt to quickly detect and report any tampering with system binaries (including shared libraries), regardless of whether anyone is attempting to sudo.