sudo and the sudoers file

Why not just log in as root?

If five admins share the root password, you cannot tell who did what, and changing the password means telling five people. sudo fixes this. Each admin logs in as themselves and puts sudo before a command that needs root. sudo checks a rules file, asks for the admin's OWN password, runs the command, and records it in /var/log/secure. Root logins can then be turned off.

[asha@web01 ~]$ dnf install -y httpd
Error: This command has to be run with superuser privileges (under the root user on most systems).
[asha@web01 ~]$ sudo dnf install -y httpd
[sudo] password for asha:
...
Complete!
[asha@web01 ~]$ sudo -i        # a full root shell, when you must do many root tasks
[root@web01 ~]# exit

The wheel group

RHEL ships /etc/sudoers with this line already active: %wheel ALL=(ALL) ALL. % means a group. So making a user an admin is one command: usermod -aG wheel asha. She needs to log in again to get the group.

Reading a sudoers rule

# who   where = (as whom)   what
asha    ALL   = (ALL)       ALL
%wheel  ALL   = (ALL)       ALL
ravi    ALL   = (root)      /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd
%ops    ALL   = (ALL)       NOPASSWD: /usr/bin/dnf

ravi above may only restart and check httpd. NOPASSWD: skips the password prompt, which is convenient for automation accounts (Ansible uses this) but should be used carefully for people.

Editing safely: visudo and sudoers.d

# visudo                                  # edit /etc/sudoers with a syntax check
# visudo -f /etc/sudoers.d/ops             # edit a drop-in file
# echo '%ops ALL=(ALL) NOPASSWD: /usr/bin/dnf' > /etc/sudoers.d/ops
# chmod 440 /etc/sudoers.d/ops
# visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/ops: parsed OK
$ sudo -l                                  # as a user: what am I allowed to run?

Prefer a small file in /etc/sudoers.d/ for each rule set instead of editing the main file. Package updates may replace /etc/sudoers, and separate files are easy to add and remove with Ansible. The main file reads the directory through a line #includedir /etc/sudoers.d (newer sudo versions also accept @includedir). The # in #includedir is NOT a comment.

Common mistakes

• Editing /etc/sudoers with plain vim and saving a typo. Use visudo.
• Giving a user sudo for an editor (sudo vim) or a shell-capable tool. From vim they can run :!bash and get a root shell. Limit commands carefully, or use sudoedit for editing.
• Writing command names without full paths in rules. Always use /usr/bin/systemctl, not systemctl.
• Making a drop-in file with a dot or ~ in its name (like ops.conf~ or ops.bak with a dot): sudo skips files whose names contain a dot or end in ~. Name it simply ops.