You're having trouble thinking about security, where the goal and the threat are as important as the solution.

For example, a short fence can be considered a security measure, though it can be purposefully stepped over. Maybe it only serves as a guide, or maybe it protects a window from a nearby soccer field.

In that same way, the sudo example you're deriding can provide the 'security' of making the proper workflows more visible to the user- without being designed to keep out a malicious professional hacker.

Sudo in this instance is an easy way to allow the user to call service without giving them root access, thus a security measure. It has nothing to do with making things more visible to the user.

Well sudo for me has one good point, i can see witch person did something with root-rights, a bit like a lightweight auditd, but security to me really means something else, its here or its not, correctly implemented or not (in a technical and especially in the management space)

While you're right, this might be a reasonable compromise if you trust the person. The advantage of restricting their sudo use is to make it harder for them to accidentally mess something up, not protect against a malicious user.

> The advantage of restricting their sudo use is to make it harder for them to accidentally mess something up, not protect against a malicious user.

What makes you think that?

Security to me means that someone that can restart a service can 'really' don't do anything else, if i trust 'the' peoples they have already root/management-console access etc, if not they have a jail/container etc. Half-backed sudo-stuff has nothing to-do with trust nor security

Apologies, I thought the distinction here was clear.

I don't think it's useful in protecting against people with the intent to break stuff. A malicious person doesn't necessarily need root to do damage, and if they do, then there are many vectors for obtaining elevated privileges from within a shell.

I do think that it's useful for keeping users from within your organization from doing damage by accident. Like, you could enabled a person to log in and restart a service, but prevent them from mucking around with configurations.

Training wheels on a bicycle make it more difficult for an inexperienced rider to accidentally fall over.

They don't stop people from intentionally doing it.

When he need's training-wells he need a training-machine (aka dev-envoirement), everyone can fall over, but not because of sudo prevents that, but typing 1000 times 'sudo' is the same like clicking that windows thing.

PS: And the cold sweat after typing something like 'rm -rfd /' is still the best training-well

Sudo has nothing to do with training wheels.

It is an analogy..

Rider: Lean to the side

Training wheels: Hey! Whoah there. If you do that you will fall.

Rider: I know, do it anyway! (sudo...)

Training wheels: Your choice, I can only prevent so much.

Rider falls over...

If a user has sudoer privileges, sudo serves as nothing more than training wheels.

User: apt install APP

System: Access denied. sudo privileges required

User: sudo apt install APP

Sytem: Okie doke

And the age old `sudo make me a sandwhich` joke continues...

Sudo is an actual security measure though. You can be allowed to run "sudo service" but not "sudo apt" for example. Far from being a training wheel.

Except it is... It is implicit in the command being an acronym for "super user do".

`sudo X` => `super-user-do X` => `I really mean to do X`

For a user that has privileges to run a command, `sudo` is equivalent to Windows popping up the "Admin Privileges Required: OK? Yes. Done" prompt to run an app when you are already an admin.

If you are already an admin (or sudoer in the Unix world), why ask? Because the command you are running is potentially destructive and you want to double check? That's fine, but it is just like training wheels.

If a user is not a sudoer, the topic is entirely irrelevant, and if sudoers do not have permission to run certain commands that is a completely different question.

But to answer the original question, "Is Sudo Almost Useless?", the answer in most cases is yes.