I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing that I was getting it incorrect because I was typing in my ssh terminal. I then received a very accusatory email about how my trying to sudo constituted a threat to the system. The tone was sustained even after I explained that it was an accident.My concrete question is: what is the threat model whereby trying a couple times to sudo without permission is considered a serious violation of system security?Note: I understand in principle why the rule is there. My guess is that you don't want people writing automated scripts trying to crack the password - or I guess try to input a password one obtained via social engineering. But a couple unsuccessful guesses for some silly command...what's the threat model?
What is the threat of a user trying to sudo without permission?
security;sudo
First off, sudo all by itself, doesn't send any emails or create warning messages, other than logging your unsuccessful attempt to the log. People who observe these logs and correlate events (most probably using a scripted log watcher), see that some user id, which happened to be yours this time, is trying to gain root access where he/she is not permitted. As a result, the automated process fires an email to the offender. Even though you think you might be responding to a human being, 9 out 10 times, your response goes into a mailbox, which is either not observed, or checked very seldom.If you think you have received a response to your explanation from an actual human, who keeps accusing you after you made clear that this was a mistake and you were not on the right server, he is either too bored and looking for something to do or have strict orders to scare people off.Other than brute force cracking attempts, there is no other threat vector in the wild at this time, attacking sudo protected servers, that I know.Also, consider asking questions of this nature in the Information Security section of Stack Exchange.