sudo - Running as Administrator in Unix (Executing Commands as root in Linux and FreeBSD), the sudoers File

Practice

Anyone who works with Unix knows about one user who has the same name on every *nix system: root. This is the so-called "superuser", who can do absolutely anything.

However, it is considered good practice — and not without reason — for even a senior Unix system administrator to work not as root, but under their own account. At the very least, this gives you:

a) The ability to always trace who exactly performed a given action, even if root privileges were requested for it, and to trace it fairly precisely;

b) The habit of getting used to running everyday commands that don't require root privileges as yourself. Then, to carry out some important task that does require root privileges, you'll have to type 5 extra characters for the "sudo" command plus a space after it, which almost subconsciously tugs at a thread: "careful!" and gives your brain half a second to think things over — which can turn out to be crucial, as your finger pauses over Enter.

So, above I already mentioned a certain "sudo".

SUDO is a utility that lets you run commands from the command line as root, on behalf of a user who is not root — that is, any authorized user.

In this case you don't need to log in as root — it's enough to log into the system under your own account. And you don't need to run the "su" command to become "root".

Delimiting privileges — who is allowed to run sudo and who is not, as well as who is allowed to run sudo without entering a password and who requires extra scrutiny — is handled by the sudoers file. On each OS this file lives in a different location.

Another plus of sudo is that the end admin does not need to know the root password, which can somewhat improve security.

Installation

FreeBSD:

# cd /usr/ports/security/sudo
# make install clean

The sudoers file is located at:

/usr/local/etc/sudoers

Linux Debian (or Ubuntu):

# aptitude install sudo

The sudoers file is located at:

/etc/sudoers

Linux CentOS (or RedHat):

# yum install sudo

The sudoers file is located at:

/etc/sudoers

The sudoers file

This file, in a fairly simple form, describes which users or groups are allowed to run the sudo command. This means that an ordinary Unix system user, even if they want to run a command as root without logging in as "root" and without running the "su" command (logical - since they don't know the password), will not be able to use superadmin privileges.

Here is an example of such a file:

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root ALL=(ALL) ALL

# Uncomment to allow members of group sudo to not need a password
# (Note that later entries override this, so you might need to move
# it further down)
# %sudo ALL=NOPASSWD: ALL

In the example, the file is configured so that only the superadmin himself can run the sudo command (this is the default state of the file in Debian). Frankly, it's useless in this form.

To add users who are allowed to use this file - list them at the end in the following format:

username ALL=(ALL) ALL

And to add entire groups (for example, the wheel group):

%groupname ALL=(ALL): ALL

With this configuration, users will be able to use the sudo utility, but they will be prompted for a password every time:

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.

[sudo] password for username:

The password you need to enter here is the user's password, not root's. That is, if user admin1 runs sudo, they enter the same password they use to log into the system itself.
This is a kind of safety net - those extra few seconds give the brain time to notice a mistake in the command and cancel the operation.

However, having to type a password every time you run a lot of commands as root (sudo) - no thanks. Of course, you could

$ sudo bash

but that's not our method.

If some administrator or group of users is trusted enough that this "checkpoint" warning asking for their password isn't needed, you can disable it. In that case, you need to enter users like this:

username ALL=(ALL) NOPASSWD: ALL
%groupname ALL=(ALL) NOPASSWD: ALL

In that case, the sudo command will be executed immediately, without any warnings whatsoever. And without any password prompts. For the listed users, of course.

Here's a second example of a sudoers file:

In this example:

a) User stadmin is allowed to run sudo without entering a password
b) Group wheel is allowed to run sudo, but with a password
c) User proger is allowed to run sudo, also with a password

As you can see, the initial sudoers setup is quite simple.

You can read more about sudo and the sudoers file, as always, in the man pages:

$ man sudo
$ man sudoers

Reading this is highly recommended, since there are some useful options that simply aren't spelled out in the sudoers file by default (there are dozens of them).

For example, you can forbid certain users from running binaries via sudo. Or require the user to chdir into their home directory when running sudo, and so on.