rh124_sudo

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
rh124_sudo [2026/10/23 09:56] – [Abbreviated /etc/sudoers] rpjdayrh124_sudo [2026/10/30 12:09] (current) – [Links] rpjday
Line 7: Line 7:
 //"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."// //"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."//
  
 +===== Links =====
 +
 +  * [[https://www.sudo.ws/|sudo home page]]
 +  * [[www.geeksforgeeks.org/linux-unix/sudo-command-in-linux-with-examples/|sudo Command in Linux]]
 +  * [[https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file|How to edit the sudoers file]]
 ===== The "wheel" group ===== ===== The "wheel" group =====
  
-All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password.+All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password by default.
  
-===== Very abbreviated /etc/sudoers =====+===== Using the same sudoers file across multiple hosts =====
  
-You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them.+You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them.  
 + 
 +===== General format of sudoers line ===== 
 + 
 +<code> 
 +username hostname = (run_as_user:run_as_group) tag:command 
 +</code> 
 + 
 +Examples: 
 + 
 +<code> 
 +username ALL=(ALL:ALL) ALL 
 +username ALL=(ALL) ALL         (shorter form of above) 
 +%groupname ALL=(ALL) NOPASSWD: ALL 
 +%groupname ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx 
 +%groupname host1,host2,host3=(ALL) ALL 
 +username host_alias=(ALL) ALL 
 +</code> 
 + 
 +===== Very abbreviated /etc/sudoers =====
  
 Note much of this file is commented out. Note much of this file is commented out.
Line 31: Line 55:
 ## rather than USERALIAS ## rather than USERALIAS
 # User_Alias ADMINS = jsmith, mikem # User_Alias ADMINS = jsmith, mikem
- 
  
 ## Command Aliases ## Command Aliases
Line 60: Line 83:
 # Cmnd_Alias DRIVERS = /sbin/modprobe # Cmnd_Alias DRIVERS = /sbin/modprobe
  
-# Defaults specification +... big snip ...
- +
-# +
-# Refuse to run if unable to disable echo on the tty. +
-# +
-Defaults   !visiblepw +
- +
-# +
-# Preserving HOME has security implications since many programs +
-# use it when searching for configuration files. Note that HOME +
-# is already set when the the env_reset option is enabled, so +
-# this option is only effective for configurations where either +
-# env_reset is disabled or HOME is present in the env_keep list. +
-# +
-Defaults    always_set_home +
-Defaults    match_group_by_gid +
- +
-# Prior to version 1.8.15, groups listed in sudoers that were not +
-# found in the system group database were passed to the group +
-# plugin, if any. Starting with 1.8.15, only groups of the form +
-# %:group are resolved via the group plugin by default. +
-# We enable always_query_group_plugin to restore old behavior. +
-# Disable this option for new behavior. +
-Defaults    always_query_group_plugin +
- +
-Defaults    env_reset +
-Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS" +
-Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" +
-Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" +
-Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" +
-Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" +
- +
-# +
-# Adding HOME to env_keep may enable a user to run unrestricted +
-# commands via sudo. +
-# +
-# Defaults   env_keep += "HOME" +
- +
-Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin+
  
 ## Next comes the main part: which users can run what software on  ## Next comes the main part: which users can run what software on 
Line 131: Line 116:
 ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment) ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
 #includedir /etc/sudoers.d #includedir /etc/sudoers.d
 +</code>
  
 +Note well the final ''#includedir'' directive, which further processes sudo files from that directory in alphabetical order.
 +
 +===== Giving the class sudo access =====
 +
 +==== Option 1 ====
 +
 +Add all class accounts to the ''wheel'' group; you still might need to type your password.
 +
 +==== Option 2 ====
 +
 +Create a new group, ''class'', add all students to that ''class'' group, and add a new file under ''/etc/sudoers.d'' with **either** of these two lines:
 +
 +<code>
 +%class ALL=(ALL) ALL
 +%class ALL=(ALL) NOPASSWD: ALL
 +</code>
 +
 +===== How to examine your own sudo capabilities =====
 +
 +<code>
 +$ sudo -l         (lower case "ell")
 </code> </code>
  • rh124_sudo.1792749404.txt.gz
  • Last modified: 2026/10/23 09:56
  • by rpjday