C0c0l0·Feb 3, 2021Submission
Sudo_pair – 2FA for individual `sudo` commands
2 points · Open discussionsquare
sudo_pair
Rust2018–2021
square / sudo_pair
sudo_pair
Plugin for sudo that requires another human to approve and monitor privileged sudo sessions
4Distinct people
6Mentions
0Explicit recommenders
1.3KGitHub stars
What to know before exploring
What it is
Plugin for sudo that requires another human to approve and monitor privileged sudo sessions
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year6 dated mentions
Observed mentions: 2018-05-07 19:49:37 UTC to 2021-02-03 18:11:34 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
6 sourcesLooks great! A couple of questions:
Can you view logs of SSH sessions after the fact?
Can you live-view a session?
Can you require a pairing authorization like with https://github.com/square/sudo_pair?
In HashiCorp BoundarySudo_pair: A tool for paired use of elevated privileges
7 points · Open discussionIt's not necessarily for deploys (though you certainly could make a workflow that uses it to do so!) but I developed a dual-control plugin for sudo while at Square. We use it extensively.
https://github.com/square/sudo_pair
In action: https://raw.githubusercontent.com/square/sudo_pair/master/de...
In Senate passes bill to decrease grid digitization, move toward manual controlGood catch. :)
It might be hard to read in the gif, but at Square, we actually allow users to approve their own sessions. When this happens, it's logged in such a way that an oncall infosec person is paged immediately. Users know not to do this except in case of emergency; the whole point is to have an in-case-of-fire-break-glass escape hatch during, e.g., a critical outage in the middle of the night.
The logic for this[1] is currently in the approval script (and in the sample one provided, it does deny access). However, I intend to make this a responsibility of the plugin itself[2] shortly, where you can toggle between denying and logging. Also, it's pretty easy to take the output from `socat`, pipe it to GPG, and archive the session afterward, for forensic purposes. We plan to do this latter part as well (possibly through the approval s
Read the rest
cript, possibly as a second plugin).
[1]: https://github.com/square/sudo_pair/blob/master/sample/bin/s...
[2]: https://github.com/square/sudo_pair/blob/master/sudo_pair/sr...
Show HN: sudo_pair – dual control for sudo
32 points · Open discussion