| Both sides previous revision Previous revision Next revision | Previous revision |
| rh124_sudo [2026/10/23 10:07] – [Very abbreviated /etc/sudoers] rpjday | rh124_sudo [2026/10/30 12:09] (current) – [Links] rpjday |
|---|
| //"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."// | //"Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives."// |
| |
| | ===== Links ===== |
| | |
| | * [[https://www.sudo.ws/|sudo home page]] |
| | * [[www.geeksforgeeks.org/linux-unix/sudo-command-in-linux-with-examples/|sudo Command in Linux]] |
| | * [[https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file|How to edit the sudoers file]] |
| ===== The "wheel" group ===== | ===== The "wheel" group ===== |
| |
| All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password by default. | All members of the ''wheel'' group can run the ''sudo'' comamand, but will still have to enter their personal password by default. |
| |
| ===== Very abbreviated /etc/sudoers ===== | ===== Using the same sudoers file across multiple hosts ===== |
| |
| You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them. | You can use the same ''/etc/sudoers'' file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the ''Host_Alias'' directive to define specific groups of machines and assign rules to them. |
| | |
| | ===== General format of sudoers line ===== |
| | |
| | <code> |
| | username hostname = (run_as_user:run_as_group) tag:command |
| | </code> |
| | |
| | Examples: |
| | |
| | <code> |
| | username ALL=(ALL:ALL) ALL |
| | username ALL=(ALL) ALL (shorter form of above) |
| | %groupname ALL=(ALL) NOPASSWD: ALL |
| | %groupname ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx |
| | %groupname host1,host2,host3=(ALL) ALL |
| | username host_alias=(ALL) ALL |
| | </code> |
| | |
| | ===== Very abbreviated /etc/sudoers ===== |
| |
| Note much of this file is commented out. | Note much of this file is commented out. |
| |
| Note well the final ''#includedir'' directive, which further processes sudo files from that directory in alphabetical order. | Note well the final ''#includedir'' directive, which further processes sudo files from that directory in alphabetical order. |
| | |
| | ===== Giving the class sudo access ===== |
| | |
| | ==== Option 1 ==== |
| | |
| | Add all class accounts to the ''wheel'' group; you still might need to type your password. |
| | |
| | ==== Option 2 ==== |
| | |
| | Create a new group, ''class'', add all students to that ''class'' group, and add a new file under ''/etc/sudoers.d'' with **either** of these two lines: |
| | |
| | <code> |
| | %class ALL=(ALL) ALL |
| | %class ALL=(ALL) NOPASSWD: ALL |
| | </code> |
| | |
| | ===== How to examine your own sudo capabilities ===== |
| | |
| | <code> |
| | $ sudo -l (lower case "ell") |
| | </code> |