Users, permissions, and processes / Stage 8 of 13 · step 6 of 8

Grant sudo to a user

~10 min

Not running Starting usually ~20 s

Situation

A new administrator has joined the team. The deploy account already exists, but sudo does not let it in: sudo -l -U deploy prints that deploy may not run sudo.

Task

Make it so that:

deploy has the right to run any command through sudo, like an administrator, while the account itself stays an ordinary one with its own UID;
the sudo configuration stays valid: sudo visudo -c passes without errors, and files in /etc/sudoers.d/ are owned by root:root with mode 0440.

sudo -l -U deploy checks deploy's rights. deploy has no password yet, so a call made as him — sudo -u deploy sudo -n … — asks for a password even with the rights in place: that is not a refusal.

The tools you need are already installed. There's no internet on this machine.

Lab goals

0 of 2

User deploy has sudo rights — not checked yet
The sudo configuration passes visudo -c; files in /etc/sudoers.d are root:root with mode 0440 — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Security · picked for this lab

sudo — running commands as another user

Cheat sheet

$_ — insert into the terminal

sudo apt update run a command as root
sudo -u postgres psql run as another user
sudo -i interactive root shell
sudo -l what I'm allowed to run
sudoedit /etc/nginx/nginx.conf safely edit a root-owned file
sudo visudo -f /etc/sudoers.d/10-x edit sudoers rules

sudoers

Rights come from membership in the sudo group (Ubuntu) / wheel (RHEL), or an explicit rule. Never edit sudoers directly — only through visudo (it checks syntax, otherwise you can lock yourself out of sudo):

bash

sudo visudo                       # the main /etc/sudoers file
sudo visudo -f /etc/sudoers.d/90-deploy   # a separate drop-in (recommended)
sudo visudo -c                    # check the syntax of all files

Rule format and aliases:

# who    where = (as whom)      what
alice   ALL = (ALL:ALL)      ALL
deploy  ALL = (root) NOPASSWD: /bin/systemctl restart myapp, /bin/systemctl status myapp
%devs   ALL = (root)         /usr/bin/apt        # %group
Cmnd_Alias SERVICES = /bin/systemctl restart nginx, /bin/systemctl reload nginx
web     ALL = (root) NOPASSWD: SERVICES

NOPASSWD: — no password prompt (for automation; keep the scope narrow!).

Options and sudoedit

Useful Defaults (in /etc/sudoers.d/):

Defaults        env_reset                          # a clean environment (safe)
Defaults        secure_path="/usr/sbin:/usr/bin:/sbin:/bin"
Defaults        timestamp_timeout=15               # password cache, minutes (0 = always ask)
Defaults:deploy !requiretty
Defaults        logfile="/var/log/sudo.log"        # a separate log

bash

sudo -E cmd                       # preserve environment variables (if allowed)
sudoedit /etc/nginx/nginx.conf    # = sudo -e: safely edit a root file with your $EDITOR
sudo -v                           # extend the password cache (for long scripts)

sudoedit edits a copy under your own name and atomically puts it back — safer than sudo vim (which never runs the editor as root).

user is not in the sudoers file

The user isn't in the sudo group. As root: usermod -aG sudo alice (needs a re-login, see users-groups).

sudo: a terminal is required to read the password

No TTY (over SSH without -t, or from a script). Options: NOPASSWD for the needed command, ssh -t, or sudo -S (password from stdin).

NOPASSWD doesn't work for switching users

(root) NOPASSWD: ALL allows commands as root, but not sudo -u other. For a passwordless switch, use an (other) rule or sudo runuser -u other -- cmd.

The command works by hand but not through sudo (PATH/env)

env_reset/secure_path clean the environment. Call it by its full path or configure secure_path; for variables, use sudo -E (if allowed).

Broke sudoers, lost access

visudo won't let you save a file with an error. If you still lost access, get in through a root console (recovery/hypervisor) and fix it.

NOPASSWD without a narrow command in the rule (NOPASSWD: ALL instead of a specific path) grants full root access with no check at all — keep the rule's scope as narrow as possible, especially for service accounts. Edit sudoers only through visudo: it checks syntax before saving, while a direct edit with a text editor can leave the system with no working way to get root at all.