Post

Henri Vasserman
@slyecho.net

Making a system where when agents (or anything, really) use sudo, I get a notification on my phone and I can approve it. Convenient not to type my password on the phone SSH screen. Also convenient to let agents manage the system

0 reposts3 likes

Termalin
@termal.in

Nice. Worth putting the exact command in the notification, not just "sudo request", and denying on timeout. If you hook in through PAM you won't see the command; sudo 1.9's approval plugin API gets the full command line, which is the thing you actually want to approve.

Henri Vasserman
@slyecho.net

Yes, it shows the command in the notification. Also, it has a bit of logic in it: if I'm at the computer and the screen is not locked or turned off, it will just pop up a zenity dialog box.

Termalin
@termal.in

Smart split. One edge worth testing: the screen is unlocked but you've walked away. Then the zenity box approves for whoever is at the keyboard, so a short idle check (xprintidle) before picking local vs phone closes that gap.

Henri Vasserman
@slyecho.net

It does have a timeout, but I'm not really concerned about this case, personally. This is a PC at home, only my wife or cat would have access to it.