OpenDoas

Both implementations of doas for Linux have (the same) unfixed security issue: - https://github.com/Duncaen/OpenDoas/issues/106 - https://github.com/slicer69/doas/issues/110 I have a hard time recommending doas over sudo on Linux when the issue has been fixed in sudo but not in doas.

Do you use doas on Linux? It is not protected against tty pushback attack: https://github.com/Duncaen/OpenDoas/issues/106 That's a pretty severe unsolved security issue.

OpenDOAS has actually had the OpenBSD-specific code removed (https://github.com/Duncaen/OpenDoas/commit/74449f015ff7a7230...), and replaces some of the doas mechanisms that rely upon OpenBSD to work with sudo-like flag files and suchlike. There are, moreover, 2 ports of doas to other systems. OpenDOAS is one. Jesse Smith's https://github.com/slicer69/doas is the other. The latter retains the OpenBSD-specific code, and is the more portable of the two at the expense of only doing everything that the tool is capable of when actually built on OpenBSD.

This is actually an interesting case. Openbsd implemented timing out the connection by adding it to the tty[1]. this sort of shenanigan would never fly on linux, "what! improve an unrelated established system, I don't think so." So for a long time doas on linux was not able to timeout a session. At some later point the timeout code was re-implemented on linux using a different mechanism[2]. If your linux doas does not timeout, try updating it? 1. http://man.openbsd.org/tty.4#TIOCSETVERAUTH 2. https://github.com/Duncaen/OpenDoas/blob/master/timestamp.c

For those whose muscle memory is all confused now there's OpenDoas: https://github.com/Duncaen/OpenDoas

Sorry, I meant to link to https://github.com/Duncaen/OpenDoas instead of https://github.com/nholstein/OpenDoas. Thank you for correcting my mistake.

FYI the doas ports you added are poorly maintained. The nholstein repo clearly states: This repository temporarily unmaintained. And the slicer69 project has had some insecure code added in the past: https://xn--1xa.duncano.de/slicer69-doas.html The awesome-openbsd repo only links to the Duncaen OpenDoas repo: https://github.com/Duncaen/OpenDoas

If you want to move away from Sudo, but don't want to try this rust implementation just yet, I have had great success with OpenBSD's doas. It has been ported to every Linux distro I know of as well: https://github.com/Duncaen/OpenDoas

There are, at both ends. Both the "script kiddies" who cannot deviate from scripts because they lack almost any knowledge at all; and the knowledgeable ones who know that there are subtle differences between sudo and doas which require doing things slightly differently to achieve the same effect. * https://github.com/Duncaen/OpenDoas/issues/116#issuecomment-...

As mentioned elsewhere, this is because it relies upon a kernel mechanism that Linux simply does not have, and fixing this involves fixing Linux. To which I add that it is important not to conflate Jesse Smith's doas, the portable doas that has code for different operating systems including OpenBSD, with Duncan Overbruck's OpenDoas, the "open" doas that is tied to Linux has has had the code for other operating systems removed and mechanisms copied in from sudo for things like timeout flag files. * https://github.com/slicer69/doas * https://github.com/Duncaen/OpenDoas

It is because openbsd persists the auth via a cookie in the terminal. that is, to do it the openbsd way a change in the tty code is required. It is odd that the linux port does not track the process id or something. http://man.openbsd.org/tty.4#TIOCSETVERAUTH A post I found on the rational behind this mechanism. https://marc.info/?l=openbsd-misc&m=150032397404966&w=2 edit: I was looking at the opendoas project and it does something with the persist option, still reading the code but it looks like it sets some sort of timestamp on file descriptor 0. update: found it, here is the timestamp code. probably a user space version of what openbsd doas does in the kernel. https://github.com/Duncaen/OpenDoas/blob/master/timestamp.c So linux doas is trying to do something. Note that per that mail post I found doas auth persist has a different scope

Why not port https://github.com/Duncaen/OpenDoas to rust instead? If the goal is security, then there is more to it than just using a memory safe language. Otherwise the result of this, possibly unwittingly, seems performative.

Yeah, but... Recently learned that it doesn't implement using a new pty, which makes it vulnerable to TIOCSTI and TIOCLINUX ioctl attacks. Which doesn't matter on OpenBSD, because OpenBSD does not have these features. But Linux does, so not ideal. https://github.com/Duncaen/OpenDoas/issues/106

In addition to what you've said, nobody is forcing anybody to use sudo. Most of my systems don't have it at all — it's simply not necessary. Some of the others use the lightweight doas ported from OpenBSD: https://github.com/Duncaen/OpenDoas