Sudo An Overview
File : /etc/sudoers
Cmd : visudo
sudo allows a permitted user to execute a command as the superuser.
The sudo utility enables the users mentioned in configuration file sudoers to have temporary access to run certain commands as the “root” or any other user.
Whenever sudo command is executed by a user, it reads the sudoers file to check whether the user is permitted to run this command.
To edit the sudo parameters in sudoers file, command visudo should only be used due to the following reasons:
• Sudoers file might not have the same location on all versions of Linux.
• Visudo checks the syntax in sudoers file after saving it and will prompt for errors.
• It gives the option to reject the changes or re-edit the file
• It prevents two users from editing the file at the same time
The visudo command should be run as root
# visudo
Syntax For sudo in sudoers file
General sudoers file record format:
user MACHINE=COMMANDS
user/group hostname = (runasuser) command(s)
root ALL=(ALL) ALL
Here,
• user/group is the name of the user or group for which sudo privileges are defined.
• hostname is a list of terminals from where user can use sudo.
• runasuser is the name of user which the sudo user is trying to act as, and must be enclosed in ( ).
• Command(s) is a list of commands that this user can execute. Complete path of the command must be specified.
# visudo
root ALL=(ALL) ALL ---- instead of root user we are adding a
normal user to run this below command in his terminal.
jeff ALL=/etc/httpd reload
User jeff can reload httpd from any terminal
# sudo /etc/init.d/httpd reload
sudo] password for jeffin:
Reloading httpd:
We can also create aliases for:
• users/groups: User_Alias
• run comands as other users: Runas_Alias
• hostname: Host_Alias
• command: Cmnd_Alias
Eg:
User_Alias USER = user1, user2
Runas_Alias PRIVUSER = root, jeff
Host_Alias SEGMENT = 192.168.1.0/24
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
Check the following example for Aliasing. For a particular user to run particular commands.
1. create a user alias
## User Aliases
User_Alias ADMINS = jeffin
2. Create a command alias
## Storage
Cmnd_Alias STORAGE = /sbin/fdisk -l
3. Now add those into user privilage specifications,
ADMINS All=STORAGE
if we give like below one, it will through as an error,
jeffin ALL=STORAGE
user/group hostname = (runasuser) command(s)
ERROR: # visudo
visudo: Warning: Runas_Alias `ADMINS' referenced but not defined
visudo: Warning: unused User_Alias ADMINS
insted of the user name give User_Alias name here
Solution: jeffin ALL=STORAGE this is wrong as we mentioned User_Alias above. So re-wright it as,
ADMINS ALL=STORAGE
ADMINS ALL=NOPASSWD:STORAGE ----------> If we give NOPASSWD we can run our commands without using our password, or else it will ask for your password.
Here ADMINS and STORAGE are user alias
4. From user side you can check for what all commands you have the permission to run. First switch as that user and use the below command,
$ sudo -l
User jeffin may run the following commands on this host:
(root) /etc/init.d/httpd reload
(root) /sbin/fdisk -l
5. switch as that user and run that command ( fdisk -l) to show the result. make sure you run this with sudo
# sudo /sbin/fdisk -l
Disk /dev/sda: 33.3 GB, 33285996544 bytes
255 heads, 63 sectors/track, 4046 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000ac2fa
Device Boot Start End Blocks Id System
/dev/sda1 * 1 39 307200 83 Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2 39 557 4161536 82 Linux swap / Solaris
Partition 2 does not end on cylinder boundary.
/dev/sda3 557 4047 28036096 83 Linux
Remember this:
• The runasuser token is optional and defaults to root if not included.
• Groups are specified in sudoers file by prefixing the group name with %.
• There can be multiple usernames in a line separated by commas.
• Multiple commands should also be separated by commas. Spaces are considered a part of the command.
• The name of alias should be in capital letters; otherwise it would give a syntax error.
• If the space in a line gets over, we can put a back slash (\) and continue on the next line.
• While running a sudo command, the user will be prompted for its own password, not the password of the user it is trying to act as.
Giving privileges for a group
1. Create a group jeep
# groupadd jeep
2. Create and add users into that group
# useradd -g jeep jeff
# useradd -g jeep jomy
3. ## Allows people in group jeep to run commands specified in the cmd-alias STORAGE
%jeep ALL=STORAGE
Here STORAGE is user alias
4. Switch as that user and run
# sudo -l
# sudo /sbin/fdisk -l
How to gain root privileges for a normal user
By using su - command, a user can login as root after entering root’s password.
But by specifying root privileges for a user in sudoers, it doesn't need to know root password to login as root for that session.
-- 'su' Substitute User
# su -
# su - root
$ su - root -c "ls -l /root"
To use a privilege of another user
# sudo -u <user to run command as> <command>
If you want to give privilages for another user give that user name in ()
jeffin ALL=(jeff) /etc/init.d/httpd reload
That says that user jeffin can (using "sudo -u ") run commands as jeff.
[jeffin@localhost ~]$ sudo -u jeff /etc/init.d/httpd reload
LogFile
By default, sudo messages are sent to syslog.
so all commands run as sudo are logged in /var/log/messages. We can create a separate sudo log file by entering the below line in sudoers file:
# visudo
#Specify default log file location
Defaults logfile=/var/log/sudolog
Granting Access for user and group together
#granting all access to specific users and groups, separated by commas,
jeffin,%jeep ALL=/etc/init.d/httpd reload
OR
jeffin,%jeep ALL=STORAGE
(STORAGE=/etc/init.d/httpd reload)
Make sure group %jeep is mentioned only in one line. Either where we mentioned group or user.
Granting access to users for specific files or Dir
This following entry allows user jeff to gain access to all the program files in the /sbin and /usr/sbin directories,
along with the privilege of running the command /usr/local/src/script.sh:
jeff ALL= /sbin/, /usr/sbin, /user/local/apache/bin/run.sh
