Skip to content

sudoers.md

Latest commit

 

History

History
297 lines (190 loc) · 6.83 KB

sudoers.md

File metadata and controls

297 lines (190 loc) · 6.83 KB
Raw

Understanding and Configuring the /etc/sudoers File in Linux

This guide provides an overview of the /etc/sudoers file in Linux, explaining how to safely edit it using visudo, understand its content, and configure user privileges and environment settings.

Viewing the /etc/sudoers File

The /etc/sudoers file defines which users or groups have the right to use sudo to execute commands with elevated privileges.

To view all active entries in the sudoers file without comments or empty lines:

cat /etc/sudoers | grep -E -v "^(#|$)"

Safely Editing the sudoers File

Editing the sudoers file directly can be risky due to potential syntax errors that could lock you out of administrative privileges. Always use the visudo command to edit this file.

Using visudo

visudo

Or specify your preferred editor:

EDITOR=vim visudo
  • visudo: Opens the sudoers file in a safe environment, performing syntax checking upon saving.
  • EDITOR=vim: Sets the editor to vim for this session.

Note: visudo ensures that only one user edits the sudoers file at a time and prevents syntax errors.

Understanding the sudoers File Content

Default Options (Defaults)

The Defaults settings control various aspects of sudo's behavior.

Password Prompt Settings

  • Defaults !visiblepw: Prevents sudo from echoing asterisks (*) when typing passwords, enhancing security against shoulder surfing.

Environment Settings

  • Defaults always_set_home: Sets the HOME environment variable to the target user's home directory.
  • Defaults match_group_by_gid: Matches groups by their Group ID (GID) rather than group name.
  • Defaults always_query_group_plugin: Always queries the group plugin when determining group membership.
  • Defaults env_reset: Resets the environment to a clean state before executing commands.

Preserving Environment Variables

Specify environment variables to keep:

Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

Secure Path

Set a secure PATH for sudo commands:

Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin

This prevents users from running unauthorized executables by restricting the directories searched for commands.

Authentication Timeout

Control how long sudo caches your credentials:

Defaults timestamp_timeout=5
  • Sets the timeout to 5 minutes.
  • After this period, sudo will prompt for a password again.

Password Requirements

Configure whether sudo requires a password and whose password is needed.

  • Defaults targetpw: Requires the password of the target user (e.g., root).
  • Defaults rootpw: Requires the root password.
  • Defaults runaspw: Requires the password of the user specified by -u.

To disable these requirements:

Defaults !targetpw
Defaults !rootpw
Defaults !runaspw

Defining Aliases

Aliases allow grouping for users, hosts, runas users, and commands.

User Aliases

User_Alias ADMINS = alice, bob, carol

Host Aliases

Host_Alias WEB_SERVERS = www1, www2, www3

Runas Aliases

Runas_Alias OP_USERS = operator, sysadmin

Command Aliases

Cmnd_Alias MAINTENANCE = /usr/bin/systemctl, /usr/bin/journalctl

User Privilege Specifications

Define what commands users or groups can execute.

Basic Syntax

user    hostlist = (runas_user : runas_group) taglist commandlist
  • user: User or %group the rule applies to.
  • hostlist: Hostnames where the rule applies.
  • runas_user: User to run the command as.
  • runas_group: Group to run the command as.
  • taglist: Optional tags like NOPASSWD, NOEXEC.
  • commandlist: Commands the user is allowed to run.

Examples

  • Allow alice to run all commands as any user:

    alice ALL=(ALL) ALL

  • Allow members of ADMINS to run maintenance commands without a password:

    %ADMINS ALL=(OP_USERS) NOPASSWD: MAINTENANCE

  • Allow bob to restart the web server as root:

    bob WEB_SERVERS=(root) /usr/sbin/systemctl restart httpd

Special Tags and Defaults

Tags

  • PASSWD: Require a password (default behavior).
  • NOPASSWD: Do not require a password.
  • NOEXEC: Prevent commands from executing further commands.
  • EXEC: Allow commands to execute other commands.
  • SETENV: Allow the user to set environment variables.
  • NOSETENV: Prevent setting environment variables.

Applying Tags

dave ALL=(ALL) NOPASSWD: /usr/bin/apt-get update

Group-Based Directives

  • %groupname: References a Unix group.

Examples

  • Allow all members of the sudo group to run any command:

    %sudo ALL=(ALL) ALL

  • Allow webadmins group to manage the web server:

    %webadmins ALL=(root) NOPASSWD: /usr/sbin/systemctl restart httpd

Using Runas Specification

Specify the user and group to run commands as.

Syntax

user hostlist = (runas_user : runas_group) commandlist
  • If runas_user or runas_group is omitted, root and the invoking user's group are assumed, respectively.

Example

  • Allow jane to run commands as dbadmin and group dbgroup:

    jane ALL=(dbadmin:dbgroup) /usr/bin/psql

  • Usage:

    sudo -u dbadmin -g dbgroup psql

Checking Sudo Privileges with sudo -l

You can verify your current sudo privileges using the sudo -l command. This is useful to determine what commands you are allowed to execute with sudo.

Usage

sudo -l

This command will list the commands you are permitted to run, according to the rules specified in the /etc/sudoers file.

Example

If your user alice runs:

sudo -l

She might see:

User alice may run the following commands on this host:
    (ALL) ALL

This indicates that alice can run all commands as any user.

Alternatively, if specific commands are permitted, they will be listed accordingly.

SUID vs sudo

SUID (Set User ID)

  • Usage: Set on executable files to allow users to run them with the file owner's permissions.
  • Limitations:
    • Less flexible—applies to individual files.
    • Potential security risks if misconfigured.
    • No logging or auditing.

sudo

  • Usage: Grants users permission to run commands as other users per sudoers rules.
  • Advantages:
    • Highly configurable.
    • Allows fine-grained control.
    • Provides logging and auditing.
    • More secure when properly configured.