SudoWn brings Unix-like sudo to Windows

With Windows Vista, the next scheduled release of Microsoft Windows due in early 2007, Microsoft has rigged Vista to ask permission to perform any “system-altering” event. Each administrative action performed, even with the proper superuser (administrator) permissions, will result in a confirmation dialog. But why wait? Users concerned with security can try sudoWn, a GPL-licensed utility that calls itself the “superuser do for limited accounts in Windows XP.” Don’t let that fool you, though — this excellent program works with anything that is Windows 2000 or newer.

SudoWn requires .Net version 2.0 or newer to be installed before attempting to install it. Once sudoWn is installed, you must choose trusted users to add to the Sudoers group. These users, when they need to run a program with administrator privileges, must enter their own account’s password. Once the correct password is entered, the sudoWn client calls the sudoWn service, which temporarily escalates the user’s group permissions to the Administrators’ Group, but only for the specific program being run. Thus while a user may normally only need basic User group permissions, he can easily use sudoWn when he needs administrative rights for tasks such as installing a new program, changing system settings, or removing old software.

You can invoke sudoWn in three ways: with the context menu’s “Superuser do…” command, with the sudo command on the command line, and in shell mode. To use the context menu, right-click on an executable, an .MSI file, or a Windows shortcut link. The “Superuser do…” menu item will be present, and selecting that will ask your password, then run the program with administrative privileges.

The sudo shell command works in a similar fashion. After starting the Microsoft Windows shell (cmd.exe), type sudo followed by the application’s file name. SudoWn will ask for your password in a dialog box.

For more complicated procedures that may require the use of several programs, you can use the shell mode, in which sudoWn allows the user to run all programs with Administrator privileges. Returning to normal mode with regular User Group permissions is as simple as clicking the sudoWn icon in the system tray.

SudoWn is more versatile than the built-in “Run as…” command. Programs are run as the user in question, rather than as another, more highly privileged user. The password for the Administrator account can stay secret, as the user needs only his own password to use sudoWn.

Of course sudoWn is not flawless. Under Unix-like system such as Linux and the BSD variants, the sudoers file can be edited to give permissions based on users, groups, and passwords for individual programs and actions. SudoWin lacks the granularity of the Unix sudo command; once a user gains administrative privileges with sudoWn, he can easily change any system settings, including deleting users, changing the Administrator’s password, and removing important system files. Thus sudoWn is a nice alternative for administrators looking to run under a least privileged account, but not for the users that they oversee. For home users, sudoWn is an excellent way to stay safe while browsing the Web and viewing email.