Users, permissions, and processes / Stage 8 of 13

Delegating commands with sudo

Not running Starting usually ~20 s

Step 6 of 8 · lab · 10 min

Grant sudo to a user

The new administrator deploy needs sudo rights. Set up access the proper, safe way.

Situation

A new administrator has joined the team. The deploy account already exists, but sudo does not let it in: sudo -l -U deploy prints that deploy may not run sudo.

Task

Make it so that:

deploy has the right to run any command through sudo, like an administrator, while the account itself stays an ordinary one with its own UID;
the sudo configuration stays valid: sudo visudo -c passes without errors, and files in /etc/sudoers.d/ are owned by root:root with mode 0440.

sudo -l -U deploy checks deploy's rights. deploy has no password yet, so a call made as him — sudo -u deploy sudo -n … — asks for a password even with the rights in place: that is not a refusal.

The tools you need are already installed. There's no internet on this machine.

Lab · on your own

No commands are given in this lab: type them in the terminal yourself. Goals are checked on the machine after every command.

Goals

0 of 2

User deploy has sudo rights — not done yet
The sudo configuration passes visudo -c; files in /etc/sudoers.d are root:root with mode 0440 — not done yet

Ctrl+Enter

Starts the machine node1 · Ubuntu 24.04

The machine is starting

Hints

0 of 3

Report a problem

Lab goals

0 of 2

User deploy has sudo rights — not done yet
The sudo configuration passes visudo -c; files in /etc/sudoers.d are root:root with mode 0440 — not done yet

node1 Ubuntu 24.04

Lab goals

0 of 2

User deploy has sudo rights — not done yet
The sudo configuration passes visudo -c; files in /etc/sudoers.d are root:root with mode 0440 — not done yet

Security · picked for this lab

sudo — running commands as another user

Cheat sheet

$_ — insert into the terminal

sudo apt update run a command as root
sudo -u postgres psql run as another user
sudo -i interactive root shell
sudo -l what I'm allowed to run
sudoedit /etc/nginx/nginx.conf safely edit a root-owned file
sudo visudo -f /etc/sudoers.d/10-x edit sudoers rules

sudoers

Rights come from membership in the sudo group (Ubuntu) / wheel (RHEL), or an explicit rule. Never edit sudoers directly — only through visudo (it checks syntax, otherwise you can lock yourself out of sudo):

bash

sudo visudo                       # the main /etc/sudoers file
sudo visudo -f /etc/sudoers.d/90-deploy   # a separate drop-in (recommended)
sudo visudo -c                    # check the syntax of all files

Rule format and aliases:

# who    where = (as whom)      what
alice   ALL = (ALL:ALL)      ALL
deploy  ALL = (root) NOPASSWD: /bin/systemctl restart myapp, /bin/systemctl status myapp
%devs   ALL = (root)         /usr/bin/apt        # %group
Cmnd_Alias SERVICES = /bin/systemctl restart nginx, /bin/systemctl reload nginx
web     ALL = (root) NOPASSWD: SERVICES

NOPASSWD: — no password prompt (for automation; keep the scope narrow!).

Options and sudoedit

Useful Defaults (in /etc/sudoers.d/):

Defaults        env_reset                          # a clean environment (safe)
Defaults        secure_path="/usr/sbin:/usr/bin:/sbin:/bin"
Defaults        timestamp_timeout=15               # password cache, minutes (0 = always ask)
Defaults:deploy !requiretty
Defaults        logfile="/var/log/sudo.log"        # a separate log

bash

sudo -E cmd                       # preserve environment variables (if allowed)
sudoedit /etc/nginx/nginx.conf    # = sudo -e: safely edit a root file with your $EDITOR
sudo -v                           # extend the password cache (for long scripts)

sudoedit edits a copy under your own name and atomically puts it back — safer than sudo vim (which never runs the editor as root).

user is not in the sudoers file

The user isn't in the sudo group. As root: usermod -aG sudo alice (needs a re-login, see users-groups).

sudo: a terminal is required to read the password

No TTY (over SSH without -t, or from a script). Options: NOPASSWD for the needed command, ssh -t, or sudo -S (password from stdin).

NOPASSWD doesn't work for switching users

(root) NOPASSWD: ALL allows commands as root, but not sudo -u other. For a passwordless switch, use an (other) rule or sudo runuser -u other -- cmd.

The command works by hand but not through sudo (PATH/env)

env_reset/secure_path clean the environment. Call it by its full path or configure secure_path; for variables, use sudo -E (if allowed).

Broke sudoers, lost access

visudo won't let you save a file with an error. If you still lost access, get in through a root console (recovery/hypervisor) and fix it.

NOPASSWD without a narrow command in the rule (NOPASSWD: ALL instead of a specific path) grants full root access with no check at all — keep the rule's scope as narrow as possible, especially for service accounts. Edit sudoers only through visudo: it checks syntax before saving, while a direct edit with a text editor can leave the system with no working way to get root at all.

Delegating commands with sudo

Situation

Task

Signing in is needed to start the machine

user is not in the sudoers file

sudo: a terminal is required to read the password

NOPASSWD doesn't work for switching users

The command works by hand but not through sudo (PATH/env)

Broke sudoers, lost access