Does EX200 exam ask about sudo and sudoers file?
“Yes, the Red Hat Certified System Administrator (RHCSA) EX200 exam can test you on sudo and the sudoers file as part of its User and Group Management objectives.”
All members of the wheel group can run the sudo comamand, but will still have to enter their personal password by default.
You can use the same /etc/sudoers file or synchronized rules across multiple Linux servers, should you want to standardize administrative access; this is done by using the Host_Alias directive to define specific groups of machines and assign rules to them.
username hostname = (run_as_user:run_as_group) tag:command
Examples:
username ALL=(ALL:ALL) ALL username ALL=(ALL) ALL (shorter form of above) %groupname ALL=(ALL) NOPASSWD: ALL %groupname ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx %groupname host1,host2,host3=(ALL) ALL username host_alias=(ALL) ALL
Note much of this file is commented out.
## This file must be edited with the 'visudo' command. ## Host Aliases ## Groups of machines. You may prefer to use hostnames (perhaps using ## wildcards for entire domains) or IP addresses instead. # Host_Alias FILESERVERS = fs1, fs2 # Host_Alias MAILSERVERS = smtp, smtp2 ## User Aliases ## These aren't often necessary, as you can use regular groups ## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname ## rather than USERALIAS # User_Alias ADMINS = jsmith, mikem ## Command Aliases ## These are groups of related commands... ## Networking # Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool ## Installation and management of software # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum ## Services # Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable ## Updating the locate database # Cmnd_Alias LOCATE = /usr/bin/updatedb ## Storage # Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount ## Delegating permissions # Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp ## Processes # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall ## Drivers # Cmnd_Alias DRIVERS = /sbin/modprobe ... big snip ... ## Next comes the main part: which users can run what software on ## which machines (the sudoers file can be shared between multiple ## systems). ## Syntax: ## ## user MACHINE=COMMANDS ## ## The COMMANDS section may have other options added to it. ## ## Allow root to run any commands anywhere root ALL=(ALL) ALL ## Allows members of the 'sys' group to run networking, software, ## service management apps and more. # %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL ## Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL ## Allows members of the users group to mount and unmount the ## cdrom as root # %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom ## Allows members of the users group to shutdown this system # %users localhost=/sbin/shutdown -h now ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment) #includedir /etc/sudoers.d
Note well the final #includedir directive, which further processes sudo files from that directory in alphabetical order.
Add all class accounts to the wheel group; you still might need to type your password.
Create a new group, class, add all students to that class group, and add a new file under /etc/sudoers.d with either of these two lines:
%class ALL=(ALL) ALL %class ALL=(ALL) NOPASSWD: ALL
$ sudo -l (lower case "ell")