On a Unix systems, for example, an ordinary user -- without administrative privileges -- can use "sudo" to run a utility program that can only be run normally as administrator. The user is only allowed to run that single program as an administrator without being granted higher access for anything else. The same is true for "runas" in Windows. In Unix, the user types "sudo" at the command prompt and is asked for the regular password to their account. In Windows, the user right clicks on the application and chooses "runas" or types "runas" at the command prompt like Unix.
The elevated access is only allowed for running that particular application. Once the user logs out of that application, he/she loses their elevated privileges.
There is a key difference, however, between sudo and runas. Sudo can be finely tuned through the /etc/sudoers property file. Runas can't be customized at the same granular level. The danger with runas is that a malicious user could get access to any application on the system and have complete control of the machine.
Sudo, on the other hand, can be finely tuned to only allow specific users to do certain tasks and, even then, with restrictions. Every user that wants to use sudo has to be added to the sudoers property file and then have the specific privileges spelled out next to the entry with their name.
But there are two caveats with sudo, as well. The sudoers property file should be edited with a tool called visudo, which checks syntax and prevents different administrators from overwriting each other's changes to the file. The other caution is to make sure no user in sudoers is given unlimited administrative access to all applications. That would be the same as giving them full administrative rights and would open the candy store, if the user had malicious intent.
Symark Software offers a commercial product, PowerBroker, to securely delegate root privileges.
For more information:
Dig Deeper on Privileged access management
Related Q&A from Joel Dubin
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums ... Continue Reading
Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good ... Continue Reading
After a server room door has been compromised, finding a more secure solution is of utmost importance. Learn how to choose a server room door that ... Continue Reading