Differences

This shows you the differences between two versions of the page.

--- rh124_sudo [2026/10/23 09:28] – created rpjday
+++ rh124_sudo [2026/10/30 12:09] (current) – [Links] rpjday
@@ Line 1: / Line 1: @@
 ====== RH124 sudo and sudoers file ======
+===== Ask Google =====
+Does EX200 exam ask about sudo and sudoers file?
+//"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."//
+===== Links =====
+  * [[https://www.sudo.ws/|sudo home page]]
+  * [[www.geeksforgeeks.org/linux-unix/sudo-command-in-linux-with-examples/|sudo Command in Linux]]
+  * [[https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file|How to edit the sudoers file]]
+===== The "wheel" group =====
+All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password by default.
+===== Using the same sudoers file across multiple hosts =====
+You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them.
+===== General format of sudoers line =====
+<code>
+username hostname = (run_as_user:run_as_group) tag:command
+</code>
+Examples:
+<code>
+username ALL=(ALL:ALL) ALL
+username ALL=(ALL) ALL         (shorter form of above)
+%groupname ALL=(ALL) NOPASSWD: ALL
+%groupname ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx
+%groupname host1,host2,host3=(ALL) ALL
+username host_alias=(ALL) ALL
+</code>
+===== Very abbreviated /etc/sudoers =====
+Note much of this file is commented out.
+<code>
+## This file must be edited with the 'visudo' command.
+## Host Aliases
+## Groups of machines. You may prefer to use hostnames (perhaps using
+## wildcards for entire domains) or IP addresses instead.
+# Host_Alias     FILESERVERS = fs1, fs2
+# Host_Alias     MAILSERVERS = smtp, smtp2
+## User Aliases
+## These aren't often necessary, as you can use regular groups
+## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
+## rather than USERALIAS
+# User_Alias ADMINS = jsmith, mikem
+## Command Aliases
+## These are groups of related commands...
+## Networking
+# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
+## Installation and management of software
+# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
+## Services
+# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
+## Updating the locate database
+# Cmnd_Alias LOCATE = /usr/bin/updatedb
+## Storage
+# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
+## Delegating permissions
+# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
+## Processes
+# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
+## Drivers
+# Cmnd_Alias DRIVERS = /sbin/modprobe
+... big snip ...
+## Next comes the main part: which users can run what software on
+## which machines (the sudoers file can be shared between multiple
+## systems).
+## Syntax:
+##
+## 	user	MACHINE=COMMANDS
+##
+## The COMMANDS section may have other options added to it.
+##
+## Allow root to run any commands anywhere
+root	ALL=(ALL) 	ALL
+## Allows members of the 'sys' group to run networking, software,
+## service management apps and more.
+# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
+## Allows people in group wheel to run all commands
+%wheel	ALL=(ALL)	ALL
+## Same thing without a password
+# %wheel	ALL=(ALL)	NOPASSWD: ALL
+## Allows members of the users group to mount and unmount the
+## cdrom as root
+# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
+## Allows members of the users group to shutdown this system
+# %users  localhost=/sbin/shutdown -h now
+## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
+#includedir /etc/sudoers.d
+</code>
+Note well the final ''#includedir'' directive, which further processes sudo files from that directory in alphabetical order.
+===== Giving the class sudo access =====
+==== Option 1 ====
+Add all class accounts to the ''wheel'' group; you still might need to type your password.
+==== Option 2 ====
+Create a new group, ''class'', add all students to that ''class'' group, and add a new file under ''/etc/sudoers.d'' with **either** of these two lines:
+<code>
+%class ALL=(ALL) ALL
+%class ALL=(ALL) NOPASSWD: ALL
+</code>
+===== How to examine your own sudo capabilities =====
+<code>
+$ sudo -l         (lower case "ell")
+</code>