Automatic Sudo or Su Privilege Elevation

Secret Server has a convenience feature that eliminates the need to manually enter a su or sudo command's password when using a proxied SSH session to a Unix or Linux server. When a user manually types a su or sudo command with a valid secret ID, the SSH proxy automatically provides the username and password to use. The user does not need to know either.

For su, the connection procedure is as follows:

  1. Secret A is created to contain the username and password for the su privilege elevation. Any potentially elevated users must have access to this secret.
  2. Using secret B, a user (with access to secret A) starts a Secret Server proxied SSH session.
  3. When the user types su at the command prompt, the SSH proxy detects it, determines the user has access to secret A, and augments the command with the secret ID for secret A via a command line argument. Any other arguments the user may have typed are left as is.
  4. The user runs the su command, and the secret ID is replaced with the user and credential from secret A.
  5. With the elevated permissions (temporarily as another user) from secret A, the user completes the desired tasks.
  6. When finished, the user uses an exit command to return to their non-elevated status based on secret B.
The added argument appears as –-secret-id <secret ID> or –id <secret ID>, such as su --secret-id 15, which is replaced by a username and password from secret ID 15 when the command runs.
Sudo does not take either secret argument and automatically types the current user's password.

Password Prompt Detection

The SSH proxy sends the password only after it detects a password prompt from the target:

  • su: The prompt must match the Regular Expression to Find Password Prompts SSH proxy setting, or the English default Password: as the last output from the target.
  • sudo: The prompt must match the same regular expression and contain the current user's username, or match one of the English defaults, Password: or password for <username>:. If your systems leave the username out of sudo prompts, such as SUSE with targetpw set in sudoers, enable the SSH Proxy: Bypass Username Check for Password Regex advanced setting. See Configuring SSH Proxies for Launchers.

If your targets display prompts in a language other than English, set the regular expression to match them. Otherwise, the session stops at the prompt and the user must type the password manually.

The SSH proxy never sends the password to a password-change prompt, such as New password:, because the target would save it as the account's new password. This check recognizes English prompts only. For other languages, write the regular expression so that it does not match your locale's password-change prompts.