rh124_sudo

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
rh124_sudo [2026/10/23 09:57] – [The "wheel" group] rpjdayrh124_sudo [2026/10/30 12:09] (current) – [Links] rpjday
Line 7: Line 7:
 //"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."// //"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."//
  
 +===== Links =====
 +
 +  * [[https://www.sudo.ws/|sudo home page]]
 +  * [[www.geeksforgeeks.org/linux-unix/sudo-command-in-linux-with-examples/|sudo Command in Linux]]
 +  * [[https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file|How to edit the sudoers file]]
 ===== The "wheel" group ===== ===== The "wheel" group =====
  
 All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password by default. All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password by default.
  
-===== Very abbreviated /etc/sudoers =====+===== Using the same sudoers file across multiple hosts =====
  
-You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them.+You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them.  
 + 
 +===== General format of sudoers line ===== 
 + 
 +<code> 
 +username hostname = (run_as_user:run_as_group) tag:command 
 +</code> 
 + 
 +Examples: 
 + 
 +<code> 
 +username ALL=(ALL:ALL) ALL 
 +username ALL=(ALL) ALL         (shorter form of above) 
 +%groupname ALL=(ALL) NOPASSWD: ALL 
 +%groupname ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx 
 +%groupname host1,host2,host3=(ALL) ALL 
 +username host_alias=(ALL) ALL 
 +</code> 
 + 
 +===== Very abbreviated /etc/sudoers =====
  
 Note much of this file is commented out. Note much of this file is commented out.
Line 31: Line 55:
 ## rather than USERALIAS ## rather than USERALIAS
 # User_Alias ADMINS = jsmith, mikem # User_Alias ADMINS = jsmith, mikem
- 
  
 ## Command Aliases ## Command Aliases
Line 60: Line 83:
 # Cmnd_Alias DRIVERS = /sbin/modprobe # Cmnd_Alias DRIVERS = /sbin/modprobe
  
-# Defaults specification +... big snip ...
- +
-# +
-# Refuse to run if unable to disable echo on the tty. +
-# +
-Defaults   !visiblepw +
- +
-# +
-# Preserving HOME has security implications since many programs +
-# use it when searching for configuration files. Note that HOME +
-# is already set when the the env_reset option is enabled, so +
-# this option is only effective for configurations where either +
-# env_reset is disabled or HOME is present in the env_keep list. +
-# +
-Defaults    always_set_home +
-Defaults    match_group_by_gid +
- +
-# Prior to version 1.8.15, groups listed in sudoers that were not +
-# found in the system group database were passed to the group +
-# plugin, if any. Starting with 1.8.15, only groups of the form +
-# %:group are resolved via the group plugin by default. +
-# We enable always_query_group_plugin to restore old behavior. +
-# Disable this option for new behavior. +
-Defaults    always_query_group_plugin +
- +
-Defaults    env_reset +
-Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS" +
-Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" +
-Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" +
-Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" +
-Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" +
- +
-# +
-# Adding HOME to env_keep may enable a user to run unrestricted +
-# commands via sudo. +
-# +
-# Defaults   env_keep += "HOME" +
- +
-Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin+
  
 ## Next comes the main part: which users can run what software on  ## Next comes the main part: which users can run what software on 
Line 131: Line 116:
 ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment) ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
 #includedir /etc/sudoers.d #includedir /etc/sudoers.d
 +</code>
  
 +Note well the final ''#includedir'' directive, which further processes sudo files from that directory in alphabetical order.
 +
 +===== Giving the class sudo access =====
 +
 +==== Option 1 ====
 +
 +Add all class accounts to the ''wheel'' group; you still might need to type your password.
 +
 +==== Option 2 ====
 +
 +Create a new group, ''class'', add all students to that ''class'' group, and add a new file under ''/etc/sudoers.d'' with **either** of these two lines:
 +
 +<code>
 +%class ALL=(ALL) ALL
 +%class ALL=(ALL) NOPASSWD: ALL
 +</code>
 +
 +===== How to examine your own sudo capabilities =====
 +
 +<code>
 +$ sudo -l         (lower case "ell")
 </code> </code>
  • rh124_sudo.1792749420.txt.gz
  • Last modified: 2026/10/23 09:57
  • by rpjday