The sudoers configuration controls:
- Who can use sudo
- Which commands users can run
- Security and privilege management
Main configuration file:
/etc/sudoers
What is sudo?
sudo means:
Super User DO
Allows normal users to run commands with elevated privileges.
Example:
sudo apt update
Sudoers File
Main file:
/etc/sudoers
Important Rule
Never edit with normal editors directly.
Wrong:
vim /etc/sudoers
Correct:
sudo visudo
visudo checks syntax before saving.
Basic sudoers Syntax
Example:
aryan ALL=(ALL:ALL) ALL
Meaning
| Part | Meaning |
|---|---|
| aryan | Username |
| ALL | Any host |
| (ALL:ALL) | Any user/group |
| ALL | Any command |
Give Full sudo Access
Add User to sudo Group
Ubuntu/Debian:
sudo usermod -aG sudo devuser
RHEL/CentOS:
sudo usermod -aG wheel devuser
Check sudo Access
sudo -l
Allow Specific Command Only
Example:
devuser ALL=(ALL) /bin/systemctl restart nginx
User can only restart nginx.
Real-World Usage
Used in:
- Automation servers
- CI/CD pipelines
- DevOps scripts
Safer Passwordless Example
jenkins ALL=(ALL) NOPASSWD: /usr/bin/docker
Allows only Docker commands.
Sudoers Include Directory
Additional configs stored in:
/etc/sudoers.d/
Example
sudo visudo -f /etc/sudoers.d/devops
Add:
devops ALL=(ALL) ALL
Why /etc/sudoers.d/ is Preferred
- Cleaner configuration
- Easier management
- Safer during updates
Common sudoers Aliases
User Alias
User_Alias DEVOPS = aryan,devuser
Command Alias
Cmnd_Alias SERVICES = /bin/systemctl restart nginx
Example Combined Rule
DEVOPS ALL=(ALL) SERVICES
Real-World DevOps Example
Kubernetes Admin Access
devops ALL=(ALL) NOPASSWD: /usr/bin/kubectl
Restrict Dangerous Commands
Example:
devuser ALL=(ALL) ALL, !/bin/rm
Blocks:
sudo rm
Check sudo Logs
Ubuntu/Debian:
cat /var/log/auth.log
RHEL/CentOS:
cat /var/log/secure
Real-World Security Importance
Improper sudo configuration can cause:
- Root privilege escalation
- Server compromise
- Unauthorized access
Best Practices
- Use visudo only
- Follow least privilege principle
- Avoid unrestricted NOPASSWD
- Use /etc/sudoers.d/ for custom configs
- Audit sudo access regularly
- Log and monitor sudo activity