Skip to main content

Chapter 9.2 - sudo Configuration

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand sudo and its role
  • Configure sudo securely
  • Create aliases and groups
  • Limit allowed commands
  • Log sudo actions
  • Understand best practices

What is sudo?​

sudo (Super User DO) allows executing commands with the privileges of another user (usually root).

Advantages:

  • No need for a root account
  • Action logging
  • Granular control
  • More secure than su

/etc/sudoers File​

Edit Safely​

# NEVER edit directly!
# Use visudo (checks syntax)
sudo visudo

# Or edit with verification
sudo visudo -f /etc/sudoers

visudo:

  • Checks syntax before saving
  • Avoids configuration errors
  • Locks the file during editing

Basic Format​

# /etc/sudoers
# Format: user  host=(runas)  commands

# Simple example
user1  ALL=(ALL:ALL)  ALL

# With NOPASSWD
user1  ALL=(ALL:ALL)  NOPASSWD: ALL

# Specific commands
user1  ALL=(ALL:ALL)  /usr/bin/systemctl, /usr/bin/docker

Detailed Syntax​

Users​

# Specific user
user1  ALL=(ALL:ALL)  ALL

# Group (prefix %)
%developers  ALL=(ALL:ALL)  ALL

# User aliases
User_Alias ADMINS = user1, user2, user3
ADMINS  ALL=(ALL:ALL)  ALL

Hosts​

# All hosts
user1  ALL=(ALL:ALL)  ALL

# Specific host
user1  server1=(ALL:ALL)  ALL

# Host aliases
Host_Alias SERVERS = server1, server2, server3
user1  SERVERS=(ALL:ALL)  ALL

Runas​

# As root
user1  ALL=(ALL:ALL)  ALL

# As specific user
user1  ALL=(www-data:ALL)  ALL

# As any user
user1  ALL=(ALL:ALL)  ALL

# Runas aliases
Runas_Alias WEBSERVERS = www-data, nginx
user1  ALL=(WEBSERVERS:ALL)  ALL

Commands​

# All commands
user1  ALL=(ALL:ALL)  ALL

# Specific commands
user1  ALL=(ALL:ALL)  /usr/bin/systemctl, /usr/bin/docker

# Directory (all commands inside)
user1  ALL=(ALL:ALL)  /usr/local/bin/

# With or without password
user1  ALL=(ALL:ALL)  NOPASSWD: /usr/bin/systemctl
user1  ALL=(ALL:ALL)  PASSWD: /usr/bin/docker

Aliases​

User_Alias​

# Group users
User_Alias ADMINS = user1, user2
User_Alias DEVELOPERS = dev1, dev2, dev3
User_Alias DEVOPS = ops1, ops2

# Usage
ADMINS  ALL=(ALL:ALL)  ALL
DEVELOPERS  ALL=(ALL:ALL)  /usr/bin/git, /usr/bin/docker

Host_Alias​

# Group hosts
Host_Alias SERVERS = server1, server2, 192.168.1.0/24
Host_Alias WORKSTATIONS = ws1, ws2

# Usage
user1  SERVERS=(ALL:ALL)  ALL

Cmnd_Alias​

# Group commands
Cmnd_Alias NETWORKING = /sbin/ifconfig, /sbin/route, /sbin/ip
Cmnd_Alias SERVICES = /usr/bin/systemctl start, /usr/bin/systemctl stop
Cmnd_Alias SOFTWARE = /usr/bin/apt, /usr/bin/yum

# Usage
user1  ALL=(ALL:ALL)  NETWORKING, SERVICES

Runas_Alias​

# Group runas users
Runas_Alias WEBSERVERS = www-data, nginx
Runas_Alias DATABASES = mysql, postgres

# Usage
user1  ALL=(WEBSERVERS:ALL)  /usr/bin/systemctl

Practical Examples​

Full Administrator​

# Full access
User_Alias ADMINS = admin1, admin2
ADMINS  ALL=(ALL:ALL)  ALL

Limited Developer​

# Development commands only
User_Alias DEVS = dev1, dev2
DEVS  ALL=(ALL:ALL)  /usr/bin/git, /usr/bin/docker, /usr/bin/npm

Webmaster​

# Web management only
user1  ALL=(www-data:ALL)  /usr/bin/systemctl restart apache2, \
                            /usr/bin/systemctl reload nginx

System Operator​

# System commands without password
User_Alias OPS = ops1, ops2
Cmnd_Alias SYSTEM = /usr/bin/systemctl, /usr/bin/journalctl
OPS  ALL=(ALL:ALL)  NOPASSWD: SYSTEM

Logging​

Configuration​

# /etc/sudoers
# Log all commands
Defaults  logfile=/var/log/sudo.log
Defaults  log_input, log_output

# Or with syslog
Defaults  syslog=auth

Viewing Logs​

# System logs
sudo grep sudo /var/log/auth.log  # Ubuntu/Debian
sudo grep sudo /var/log/secure    # Red Hat/CentOS

# Custom file
sudo tail -f /var/log/sudo.log

# View commands from a user
sudo grep "user1" /var/log/auth.log | grep sudo

Best Practices​

Security​

# 1. Limit commands
user1  ALL=(ALL:ALL)  /usr/bin/systemctl, /usr/bin/docker

# 2. Avoid NOPASSWD unless necessary
user1  ALL=(ALL:ALL)  NOPASSWD: /usr/bin/systemctl status

# 3. Use aliases
User_Alias ADMINS = user1, user2
ADMINS  ALL=(ALL:ALL)  ALL

# 4. Log actions
Defaults  logfile=/var/log/sudo.log

# 5. Appropriate timeout
Defaults  timestamp_timeout=15  # 15 minutes

Maintenance​

# Check configuration
sudo visudo -c

# Test permissions
sudo -l  # View current permissions

# View history
sudo grep sudo /var/log/auth.log

Included Files​

/etc/sudoers.d/​

# Create separate file
sudo visudo -f /etc/sudoers.d/user1

# Content
user1  ALL=(ALL:ALL)  /usr/bin/systemctl

# Advantages:
# - Organization
# - Easy to manage
# - No conflict with main sudoers

Note: Files in /etc/sudoers.d/ are included automatically.

Summary​

In this chapter, you learned:

sudo: Execute commands with elevated privileges
visudo: Safe editor with syntax checking
Syntax: user host=(runas) commands
Aliases: User_Alias, Host_Alias, Cmnd_Alias, Runas_Alias
Logging: Logs of sudo actions
Practice: Limit commands, use aliases, log actions

Next Steps​

Chapter 9.3: Firewall (iptables, firewalld, ufw)
Chapter 9.4: Security Auditing and Monitoring

Chapter created on: December 2024