Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can I create a different permission to access the hosts files so that the sudoer needs this extra key in order to access it? Also, would password protecting the file prevent OS from accessing it freely in any other way?

share|improve this question
1  
It doesn't look like you know what you're doing. It'd help if you explained your situation a bit further. –  Daniel Beck Apr 21 '12 at 14:29

3 Answers 3

For the /etc/hosts file to work, applications should be able to read it freely; otherwise it won't work. Therefore if you password protect it (e.g. encrypt it with a password) from being readable, it would become useless unless somehow you can incorporate the password in the call. As for writing to the file; a sudoer may do whatever he/she needs, including overwrite it, so that won't work either.

share|improve this answer

The hosts file have the same permissions options as any other file. By default only the root user is allowed to make changes. If people that you do not trust know the root password, change it and create another user with the permissions they need, and they will no longer be able to modify files you want to protect.

share|improve this answer
    
If people you do not trust know the root password, you need to change the root password. Anyone with full root access can read and write any file, or change its ownership, regardless of which account owns it. –  Keith Thompson Apr 21 '12 at 14:04

sudo doesn't have to give full root access to all listed users. You can edit /etc/sudoers to give certain users the ability to run a restricted set of commands as root (or as some other account).

So you can, for example, give some users permission to execute commands that read certain files that they otherwise wouldn't be able to read, and then give some more trusted users permission to execute, say, /bin/vi /etc/hosts.

Note that you have to be very careful about the commands you enable in /etc/sudoers. For example, if you give a user permission to execute /bin/view /etc/hosts, that user can type :se noro (:set noreadonly) to get write access to the file, or :!bash -l and get a root shell.

Anyone who has full root access, either by knowing the root password (if there is one) or via /etc/sudoers, will be able to modify /etc/hosts no matter what its permissions are.

Note that the word "access" refers to both reading and writing. Everyone on the system should be able to read /etc/hosts; I presume you're concerned with write access.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.