Sudo and its alternatives

Posted Apr 2, 2024 19:04 UTC (Tue) by ssokolow (guest, #94568)
Parent article: Sudo and its alternatives

However, sudo-rs does call out to Pluggable Authentication Modules (PAM) to authenticate the user, so it can support non-local authentication schemes such as LDAP and Kerberos via the usual Linux mechanism for that.

Also useful for libpam-u2f as a way to add an unblockable blinking indicator (your U2F token's hardware 'touch me' prompt) and physical access requirement for some or all attempts to sneakily use credentials gained from wetware exploits.