Thoughts on NOPASSWD and disabling agent forwarding on publictest machines?

[Ricky Zhou]

Hey, I've been thinking about sudo passwords (particularly on publictest
machines, where security holes in apps being developed cant turn up from
time to time).  

Could enabling NOPASSWD for sudo and disabling agent forwarding on
publictest machines be a good option for lowering the possible impact if
anything were to happen on the publictest machines?

The specific situation that I'm thinking about right now is:
 * Command execution hole in some app in testing (this has happened)
 * Kernel bugs like the two that have shown up in the past month
 * People like me regularly entering their FAS password on publictest
   machines and having SSH agent forwarding enabled

Maybe this is being too paranoid or not the best ultimate solution (Mike
mentioned that he was looking into alternatives to entering sudo
passwords, for example), but it does seem like a real risk given the
freedom we allow for testing stuff out on the publictest machines.

Thanks,
Ricky
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-infrastructure-list/attachments/20090815/abff504b/attachment.sig>