Documentation
Linux
Using "sudoers" for better sudo management

Using "sudoers" for better sudo management

What is sudoers?

Adding users to the sudo (or wheel) group grants them broad administrative privileges, sometimes unnecessary privileges. By using the sudoers file, located in /etc/sudoers, we can implement precise control over what each user can do with sudo.

It’s is a configuration file for the sudo command on Unix-like operating systems. This file dictates which users or groups can escalate privilege and execute commands as the superuser or another user.

Why use sudoers file?

  1. Security - It limits the commands users can execute, reducing the risk of malicious changes. This is important when running remote CI/CD jobs, as it restricts command execution to only what the pipeline actually requires.

  2. Accountability - It can logs all sudo commands, so we can track who executed what commands via sudo and when. You can even log specific user/group’s usage of sudo.

  3. Flexibility -Specifying which commands can be run by which users or groups, and under what circumstances as we are going to see below.

  4. Convenience - It can grant temporary elevated privileges without needing to share the root password.

How to configure the sudoers file

To edit the sudoers file, you can manually edit /etc/sudoersbut it’s better to use the visudo command, which opens the file in the default text editor while checking for syntax errors before saving.

Here’s a basic guide on configuring it:

Open the sudoers file 

sudo visudo

Grant user privileges

To grant a user (username) the ability to run all commands as any user, add the following line (see the following section to understand the sudoers syntax):

/etc/sudoers
username ALL=(ALL:ALL) ALL

Grant group privileges

To grant a group (groupname) the same privileges. Note that we’re using the % symbol to reference the group name:

/etc/sudoers
%groupname ALL=(ALL:ALL) ALL

Allow specific commands

To restrict a user (username) to use sudo for specific command, such as copying from paths that require sudo for privilege escalation:

ℹ️
It is important to use the absolute path to the executable here
/etc/sudoers
username ALL=(ALL) /bin/cp

Understanding the sudoers file syntax

The line username ALL=(ALL:ALL) ALL in the sudoers file is a syntax used to define permissions for a user or group and what command is associated with them. It translate to:

USER/HOSTNAME=(USER:GROUP) COMMAND(s)

So, username ALL=(ALL:ALL) ALL means the user can execute any command as any user and group on any host. The following is an example of setting limited privilege escalation for a user “foo” on a host called webserver to only use sudo for only working with apt package manager and moving files

/etc/sudoers
foo webserver=(foo:developers) /usr/bin/apt, /usr/bin/mv

Using aliases

You can use aliases for commands and reference them in different places in your files using the CmndAlias sudoers syntax:

/etc/sudoers
# You can use comments!!
# Put all commands in an alias
Cmnd_Alias FILE_OPERATIONS = /usr/bin/tar, /usr/bin/mv, /bin/rm

# Allow user to use commands via sudo
gitlab-runner webserver=(ALL:ALL) FILE_OPERATIONS

Organize privilege escalation in the sudoers.d directory

For better organization and to keep the main sudoers file clean, you can use the /etc/sudoers.d/ directory. This directory allows you to create individual configuration files for different users or groups.

Create a new file

Create a file for the user or group

sudo touch /etc/sudoers.d/username

Edit the file

Use visudo to edit the new file:

sudo visudo -f /etc/sudoers.d/username

Add configuration

Add the necessary configuration, similar to how you would in the main sudoers file:

/etc/sudoers
username ALL=(ALL:ALL) ALL

Ensure sudoers file is referencing the sudoers.d directory

Usually this is included at the very end of the default sudoers file, but just ensure sure the below line exists (notice the @ symbol to reference the directory). Without this line, sudoers will not be able to load the content from the sudoers.d directory.

/etc/sudoers
@includedir /etc/sudoers.d

Log sudo commands for users

We can log users in/out commands when using sudo :

/etc/sudoers
# Note that we're using `%` to reference a group name
%developers    ALL=(ALL) LOG_INPUT: LOG_OUTPUT: ALL

In the main sudoers file, you can specify the default file for the log. You can also store specific log files for certain users

/etc/sudoers
Defaults    iolog_dir=/var/log/sudo-io/%{user}

Allow sudo without using password

Add the NOPASSWD directive. The no-password might be handy when running commands via non interactive shells like CI/CD jobs

/etc/sudoers
%gitlab-runner    ALL=(ALL) NOPASSWD: LOG_INPUT: LOG_OUTPUT: ALL
Understanding inodes