LearnLinux › LearnLinux › CMDS

sudo Command Reference

Complete Guide to Installation, Configuration, Deployment, and Usage

sudo (superuser do) allows authorized users to execute commands with elevated privileges, typically as the root user. It provides fine-grained access control, comprehensive logging, and enhanced security compared to direct root access. This guide covers everything from installation through advanced configuration and real-world usage scenarios.

Table of Contents

Overview and Concepts

What is sudo?

sudo provides a mechanism for granting administrator privileges to regular users on a temporary basis. Instead of sharing the root password or requiring users to log in as root, sudo allows controlled access to privileged commands while maintaining accountability through comprehensive logging.

Key Features

  • Granular Control: Specify exactly which commands users can run with elevated privileges
  • Logging: All sudo commands are logged with username, timestamp, command, and working directory
  • Timeout: Credentials are cached for a short period (default 15 minutes) to avoid repeated password prompts
  • Environment Control: Sanitize environment variables to prevent security vulnerabilities
  • Flexible Authentication: Support for passwords, certificates, and integration with authentication systems
  • Command Aliases: Group related commands for easier management

sudo vs. su

Feature sudo su
Password Required User's own password Root password
Logging Comprehensive command logging Limited logging
Accountability Tracks which user ran which command Only shows who switched to root
Granularity Can restrict to specific commands Full root shell access
Session Single command or temporary shell New shell session as target user
Security More secure (minimal privilege principle) Less secure (full root access)
💡 Best Practice

Use sudo instead of su for administrative tasks. This provides better accountability, security, and adheres to the principle of least privilege.

Installation and Setup

Checking if sudo is Installed

# Check if sudo is installed
which sudo

# Check sudo version
sudo -V

# Check if your user has sudo access
sudo -l

Installing sudo

Red Hat / CentOS / Oracle Linux / Fedora

# Install sudo
yum install sudo

# Or on newer systems
dnf install sudo

# Verify installation
rpm -qa | grep sudo

Debian / Ubuntu

# Update package list
apt update

# Install sudo
apt install sudo

# Verify installation
dpkg -l | grep sudo

SUSE / OpenSUSE

# Install sudo
zypper install sudo

# Verify installation
rpm -qa | grep sudo

Arch Linux

# Install sudo
pacman -S sudo

# Verify installation
pacman -Q sudo

Initial Configuration

After installing sudo, you need to add users to the sudoers configuration. This should be done as root.

Method 1: Add User to sudo/wheel Group (Recommended)

# Red Hat / CentOS / Oracle Linux (wheel group)
usermod -aG wheel username

# Debian / Ubuntu (sudo group)
usermod -aG sudo username

# Verify group membership
groups username

# User needs to log out and back in for changes to take effect
# Or use: su - username

Method 2: Edit sudoers File Directly

# ALWAYS use visudo to edit sudoers file
visudo

# Add line for specific user
username ALL=(ALL:ALL) ALL

# Or for passwordless sudo (use cautiously)
username ALL=(ALL:ALL) NOPASSWD: ALL
⚠ī¸ CRITICAL WARNING

NEVER edit /etc/sudoers directly with a text editor! Always use visudo which performs syntax checking before saving. A syntax error in sudoers can lock you out of sudo access entirely.

Post-Installation Verification

# Test sudo access as the user
sudo whoami
# Should output: root

# List user's sudo privileges
sudo -l

# Test with a safe command
sudo ls /root

# Check sudo logs
sudo tail /var/log/auth.log    # Debian/Ubuntu
sudo tail /var/log/secure      # Red Hat/CentOS

Configuration Files

Primary Configuration Files

File/Directory Purpose Notes
/etc/sudoers Main sudo configuration file Edit only with visudo
/etc/sudoers.d/ Directory for modular sudo configurations Preferred for custom rules
/etc/sudo.conf Front-end sudo configuration Plugin paths, debug settings
/var/log/secure sudo logs (Red Hat/CentOS) Contains all sudo activity
/var/log/auth.log sudo logs (Debian/Ubuntu) Contains all sudo activity
/var/db/sudo/ Timestamp directory Credential cache files

Using /etc/sudoers.d/ for Modular Configuration

The /etc/sudoers.d/ directory allows you to create separate configuration files for different purposes, making management easier and updates safer.

# Create a new sudo rule file
sudo visudo -f /etc/sudoers.d/developers

# File naming rules:
# - No dots (.) in filename except for extension
# - No tilde (~) in filename
# - Recommended: use alphanumeric characters and underscores
# Good examples: developers, web_admins, backup_users
# Bad examples: dev.ops, users~backup, admin.conf
💡 Best Practice

Use /etc/sudoers.d/ for custom configurations. This keeps your rules organized, makes updates easier, and prevents conflicts during system updates that might modify /etc/sudoers.

Example sudoers.d File Structure

# Create separate files for different groups/purposes
/etc/sudoers.d/
├── 10-admins          # Full sudo access for admin group
├── 20-developers      # Limited access for developers
├── 30-database        # Database admin commands
├── 40-webadmins       # Web server management
└── 50-backup          # Backup operations

Configuration File Permissions

Security-critical files require specific permissions:

# Check permissions
ls -l /etc/sudoers
ls -l /etc/sudoers.d/

# Correct permissions for sudoers files
# Owner: root, Group: root, Permissions: 0440 (r--r-----)
sudo chmod 0440 /etc/sudoers
sudo chmod 0440 /etc/sudoers.d/*
sudo chown root:root /etc/sudoers
sudo chown root:root /etc/sudoers.d/*
⚠ī¸ Security Warning

Incorrect permissions on sudoers files can either prevent sudo from working or create security vulnerabilities. Always verify permissions after creating or modifying configuration files.

sudoers File Syntax

Basic Syntax

user_list host_list = (run_as_list) tag_list: command_list

Breaking down each component:

  • user_list: Users or groups who can run commands
  • host_list: Hosts where the rule applies
  • run_as_list: Users/groups to run commands as
  • tag_list: Special tags like NOPASSWD, PASSWD, NOEXEC
  • command_list: Commands that can be executed

Common Rule Examples

# Grant full sudo access (like root)
username ALL=(ALL:ALL) ALL

# Allow specific command only
username ALL=(ALL) /usr/bin/systemctl restart httpd

# Allow multiple commands
username ALL=(ALL) /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd

# No password required (use with caution!)
username ALL=(ALL) NOPASSWD: ALL

# No password for specific commands only
username ALL=(ALL) NOPASSWD: /sbin/reboot, /sbin/shutdown

# Group-based permissions (% prefix)
%wheel ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL
%developers ALL=(ALL) /usr/bin/git, /usr/bin/systemctl

# Run as specific user
username ALL=(apache) /usr/bin/vim /var/www/html/*

# Host-specific rules
username webserver1=(ALL) ALL
username dbserver1=(postgres) /usr/bin/psql

# Exclude specific commands
username ALL=(ALL) ALL, !/bin/su, !/usr/bin/passwd root

# Complex rule with options
username ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx, \
                   PASSWD: /usr/bin/systemctl stop nginx

Aliases

Aliases make sudoers files more readable and maintainable by grouping related items.

User Aliases

# Define user aliases
User_Alias ADMINS = john, jane, bob
User_Alias WEBDEVS = alice, charlie, dave
User_Alias DBADMINS = frank, grace

# Use aliases in rules
ADMINS ALL=(ALL:ALL) ALL
WEBDEVS ALL=(ALL) /usr/bin/systemctl * httpd, /usr/bin/systemctl * nginx
DBADMINS ALL=(postgres) /usr/bin/psql, /usr/bin/pg_dump

Command Aliases

# Define command aliases
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, \
                        /sbin/dhclient, /usr/bin/net, /sbin/iptables, \
                        /usr/bin/systemctl * NetworkManager

Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum, \
                      /usr/bin/dnf, /usr/bin/apt, /usr/bin/apt-get

Cmnd_Alias SERVICES = /usr/bin/systemctl start, /usr/bin/systemctl stop, \
                      /usr/bin/systemctl restart, /usr/bin/systemctl status

Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, \
                     /sbin/partprobe, /bin/mount, /bin/umount

Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, \
                       /usr/bin/killall, /usr/bin/pkill

# Use command aliases
ADMINS ALL = ALL
%netadmins ALL = NETWORKING
%developers ALL = SOFTWARE, SERVICES
%storage_admins ALL = STORAGE
%operators ALL = PROCESSES, SERVICES

Host Aliases

# Define host aliases
Host_Alias WEBSERVERS = web1, web2, web3, 192.168.1.10
Host_Alias DBSERVERS = db1, db2, db3
Host_Alias FILESERVERS = file1, file2, 192.168.1.50

# Use host aliases
WEBDEVS WEBSERVERS = SERVICES
DBADMINS DBSERVERS = (postgres) ALL
%backup FILESERVERS = /usr/bin/rsync, /usr/bin/tar

Run As Aliases

# Define runas aliases
Runas_Alias WEB = apache, nginx, www-data
Runas_Alias DB = postgres, mysql
Runas_Alias SERVICES = systemd-network, systemd-resolve

# Use runas aliases
%webadmins ALL = (WEB) ALL
%dbadmins ALL = (DB) ALL

Special Tags

Tag Description Example
NOPASSWD: Don't require password user ALL=(ALL) NOPASSWD: /sbin/reboot
PASSWD: Require password (default, explicit) user ALL=(ALL) PASSWD: /usr/bin/vim
NOEXEC: Prevent executing other programs from within user ALL=(ALL) NOEXEC: /usr/bin/less
EXEC: Allow executing other programs (default) user ALL=(ALL) EXEC: /usr/bin/vim
SETENV: Allow user to set environment variables user ALL=(ALL) SETENV: /usr/bin/myapp
NOSETENV: Don't allow setting environment variables user ALL=(ALL) NOSETENV: /bin/bash
LOG_INPUT: Log standard input user ALL=(ALL) LOG_INPUT: ALL
LOG_OUTPUT: Log standard output and error user ALL=(ALL) LOG_OUTPUT: ALL

Default Settings

Defaults modify sudo behavior globally or for specific users, hosts, or commands.

# Global defaults
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Credential caching timeout (in minutes)
Defaults timestamp_timeout=15

# Disable credential caching
Defaults timestamp_timeout=0

# Always require password
Defaults:username timestamp_timeout=0

# Custom password prompt
Defaults passprompt="[sudo] password for %p: "

# Send mail on sudo errors
Defaults mailto="admin@example.com"
Defaults mail_always

# Keep environment variables
Defaults env_keep += "HOME EDITOR VISUAL"

# Log input/output for specific users
Defaults:john log_input, log_output
Defaults logfile="/var/log/sudo.log"

# Lecture settings (warning message)
Defaults lecture=always
Defaults lecture_file="/etc/sudo_lecture.txt"

# Insults mode (humorous error messages)
Defaults insults

# Command timeout
Defaults command_timeout=300

Wildcards and Patterns

# Allow all systemctl commands
user ALL=(ALL) /usr/bin/systemctl *

# Allow systemctl for specific services only
user ALL=(ALL) /usr/bin/systemctl * httpd
user ALL=(ALL) /usr/bin/systemctl * nginx

# Allow editing files in directory
user ALL=(ALL) /usr/bin/vim /etc/httpd/conf.d/*

# Allow but exclude specific items
user ALL=(ALL) /usr/bin/*, !/usr/bin/passwd
⚠ī¸ Wildcard Security Risk

Be extremely careful with wildcards! /bin/* could allow users to run shell scripts that escalate privileges. Always be as specific as possible and test your rules thoroughly.

Comments and Documentation

# Comments start with hash
# Use comments to document your rules

# Allow wheel group full access
%wheel ALL=(ALL:ALL) ALL

# Allow developers to restart web services
# Added: 2024-11-07, Requested by: John Doe
User_Alias WEBDEVS = alice, bob, charlie
Cmnd_Alias WEBSERVICES = /usr/bin/systemctl * httpd, /usr/bin/systemctl * nginx
WEBDEVS ALL=(ALL) NOPASSWD: WEBSERVICES

Deployment Strategies

Small Environment (Single Server)

For a single server or small number of servers, directly editing configuration files works well.

# Edit main sudoers file
sudo visudo

# Or create specific file in sudoers.d
sudo visudo -f /etc/sudoers.d/local_admins

# Example configuration
# Allow admin group full access
%admin ALL=(ALL:ALL) ALL

# Allow specific user to restart web services
webadmin ALL=(ALL) NOPASSWD: /usr/bin/systemctl * httpd, /usr/bin/systemctl * nginx

# Verify syntax
sudo visudo -c

Medium Environment (Multiple Servers)

Use configuration management tools to deploy consistent sudo configurations.

Using Ansible

# ansible/roles/sudo/tasks/main.yml
---
- name: Install sudo
  package:
    name: sudo
    state: present

- name: Create sudoers.d directory
  file:
    path: /etc/sudoers.d
    state: directory
    owner: root
    group: root
    mode: '0750'

- name: Deploy sudo configuration
  template:
    src: sudoers.j2
    dest: /etc/sudoers.d/company
    owner: root
    group: root
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Add admin users to wheel group
  user:
    name: "{{ item }}"
    groups: wheel
    append: yes
  loop: "{{ admin_users }}"

Using Puppet

# puppet/modules/sudo/manifests/init.pp
class sudo {
  package { 'sudo':
    ensure => installed,
  }

  file { '/etc/sudoers.d/company':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0440',
    content => template('sudo/company.erb'),
    require => Package['sudo'],
    validate_cmd => '/usr/sbin/visudo -cf %',
  }
}

Large Enterprise Environment

For large environments, consider centralized authentication and authorization.

LDAP/Active Directory Integration

# Install sssd for AD/LDAP integration
yum install sssd sssd-tools sudo

# Configure SSSD (/etc/sssd/sssd.conf)
[domain/example.com]
ldap_sudo_search_base = ou=sudoers,dc=example,dc=com
ldap_sudo_full_refresh_interval = 86400
ldap_sudo_smart_refresh_interval = 3600

[sssd]
services = nss, pam, sudo
config_file_version = 2
domains = example.com

# Enable sssd
systemctl enable sssd
systemctl start sssd

# Test sudo rules from LDAP
sudo -l

Using sudo with FreeIPA

# Create sudo rule in FreeIPA
ipa sudorule-add webadmins_restart_httpd

# Add users to the rule
ipa sudorule-add-user --users=alice,bob webadmins_restart_httpd

# Add commands to the rule
ipa sudocmd-add '/usr/bin/systemctl restart httpd'
ipa sudorule-add-allow-command --sudocmds='/usr/bin/systemctl restart httpd' \
  webadmins_restart_httpd

# Add hosts where rule applies
ipa sudorule-add-host --hostgroups=webservers webadmins_restart_httpd

# On client systems, test
sudo -l

Testing and Validation

# Check syntax before deploying
sudo visudo -c
sudo visudo -c -f /etc/sudoers.d/myfile

# Test as specific user without switching
sudo -l -U username

# Verbose test
sudo -l -U username -v

# Test specific command
sudo -U username -l /usr/bin/systemctl

# Dry run in configuration management
ansible-playbook --check sudo.yml
puppet agent --test --noop
💡 Deployment Best Practice
  1. Always test on development systems first
  2. Use syntax validation before deployment
  3. Deploy to canary servers before full rollout
  4. Keep backups of working configurations
  5. Document all changes with comments
  6. Use version control for sudo configurations
  7. Have a rollback plan ready

Command Usage and Options

Basic Syntax

sudo [options] command [arguments]

Common Options

Option Description Example
-u USER Run command as specified user sudo -u apache cat /var/log/httpd/access_log
-g GROUP Run command as specified group sudo -g wheel /usr/bin/id
-i Login shell (simulate initial login) sudo -i
-s Run shell specified in SHELL environment sudo -s
-l List user's privileges sudo -l
-l -U USER List another user's privileges sudo -l -U alice
-v Validate credentials (refresh timeout) sudo -v
-k Invalidate credentials (force password) sudo -k
-K Remove cached credentials completely sudo -K
-b Run command in background sudo -b /usr/bin/updatedb
-E Preserve user environment sudo -E /usr/bin/myapp
-H Set HOME to target user's home sudo -H -u postgres psql
-n Non-interactive (fail if password needed) sudo -n systemctl restart httpd
-S Read password from stdin echo "password" | sudo -S command
-A Use askpass program for password sudo -A command
-V Display version information sudo -V
-- Stop processing options sudo -- command --with-dashes

Environment Variable Options

Environment Variable Description
SUDO_PROMPT Custom password prompt
SUDO_ASKPASS Path to askpass program
SUDO_USER User who invoked sudo (set by sudo)
SUDO_UID UID of user who invoked sudo
SUDO_GID GID of user who invoked sudo
SUDO_COMMAND Command run with sudo

Interactive Usage Examples

# Run single command as root
sudo systemctl restart httpd

# Run command as different user
sudo -u postgres psql mydatabase

# Get root shell (similar to su -)
sudo -i

# Get root shell in current directory
sudo -s

# Run multiple commands in root shell
sudo bash -c 'command1 && command2 && command3'

# Preserve environment variables
sudo -E bash

# Run GUI application as root
sudo -E gedit /etc/hosts

# Background process
sudo -b /usr/bin/updatedb

# Check what you can do
sudo -l

# Validate credentials (extend timeout)
sudo -v

# Invalidate credentials
sudo -k

Practical Examples

System Administration Tasks

# Package management
sudo yum update
sudo apt update && sudo apt upgrade
sudo dnf install httpd
sudo zypper refresh

# Service management
sudo systemctl start httpd
sudo systemctl stop nginx
sudo systemctl restart postgresql
sudo systemctl status firewalld
sudo systemctl enable mariadb
sudo systemctl disable cups

# File operations requiring privileges
sudo cp config.txt /etc/myapp/
sudo chown apache:apache /var/www/html/index.html
sudo chmod 644 /etc/httpd/conf.d/ssl.conf
sudo mkdir -p /opt/myapp
sudo rm -rf /tmp/old_logs

# User management
sudo useradd -m -s /bin/bash newuser
sudo passwd username
sudo usermod -aG wheel username
sudo userdel username

# Firewall management
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --reload
sudo iptables -L -n -v

# Disk operations
sudo fdisk -l
sudo mount /dev/sdb1 /mnt/backup
sudo umount /mnt/backup
sudo mkfs.ext4 /dev/sdb1

# Log viewing
sudo tail -f /var/log/messages
sudo journalctl -u httpd -f
sudo less /var/log/secure

Web Server Administration

# Apache/httpd management
sudo systemctl restart httpd
sudo apachectl configtest
sudo httpd -t

# Edit configuration
sudo vim /etc/httpd/conf/httpd.conf
sudo vim /etc/httpd/conf.d/vhost.conf

# Check logs
sudo tail -f /var/log/httpd/access_log
sudo tail -f /var/log/httpd/error_log

# Certificate management
sudo certbot --apache
sudo certbot renew

# Permissions for web content
sudo chown -R apache:apache /var/www/html
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;

Database Administration

# PostgreSQL as postgres user
sudo -u postgres psql
sudo -u postgres createdb mydatabase
sudo -u postgres pg_dump mydatabase > backup.sql
sudo -u postgres psql mydatabase <  backup.sql

# MySQL/MariaDB
sudo systemctl restart mariadb
sudo mysql_secure_installation
sudo mysql -u root -p

# MongoDB
sudo systemctl start mongod
sudo -u mongodb mongosh

Network Configuration

# Network interface management
sudo ip addr add 192.168.1.100/24 dev eth0
sudo ip link set eth0 up
sudo ip route add default via 192.168.1.1

# NetworkManager
sudo nmcli connection up eth0
sudo nmcli device wifi connect "SSID" password "password"

# DNS configuration
sudo vim /etc/resolv.conf
sudo systemctl restart systemd-resolved

# Hostname
sudo hostnamectl set-hostname newname.example.com

Running Scripts

# Execute script as root
sudo /usr/local/bin/backup.sh

# Execute script as different user
sudo -u webuser /home/webuser/deploy.sh

# Execute with environment preserved
sudo -E /home/user/script.sh

# Pipe operations
cat file.txt | sudo tee /etc/config.txt
echo "content" | sudo tee -a /etc/file.txt

# Complex command sequences
sudo bash -c 'mkdir -p /opt/app && cd /opt/app && tar xzf /tmp/app.tar.gz'

Automation and Scripts

#!/bin/bash
# Script using sudo for privileged operations

# Check if running with sudo
if [ "$EUID" -ne 0 ]; then
    echo "Please run with sudo"
    exit 1
fi

# Perform privileged operations
systemctl restart httpd
echo "Service restarted"

# Or use sudo within script
sudo systemctl restart httpd
sudo chown apache:apache /var/www/html/*

# For automation (cron), use NOPASSWD in sudoers
# crontab entry:
# 0 2 * * * /usr/bin/sudo /usr/local/bin/backup.sh

Editing Files

# Edit system files
sudo vim /etc/hosts
sudo nano /etc/ssh/sshd_config
sudo emacs /etc/default/grub

# Edit as different user
sudo -u apache vim /var/www/html/config.php

# Using sudoedit (recommended for security)
sudoedit /etc/hosts
SUDO_EDITOR=nano sudoedit /etc/ssh/sshd_config
ℹī¸ sudoedit vs sudo vim

sudoedit is more secure than sudo vim because it:

  • Creates a temporary copy of the file
  • Edits with your regular privileges
  • Only elevates privileges when writing back
  • Prevents shell escapes from editors

Security Best Practices

Principle of Least Privilege

💡 Core Security Principle

Grant users only the minimum privileges necessary to perform their job functions. Avoid giving blanket ALL permissions unless absolutely necessary.

Good Practice Examples

# ✅ GOOD: Specific commands only
webadmin ALL=(ALL) /usr/bin/systemctl restart httpd, \
                   /usr/bin/systemctl status httpd, \
                   /usr/bin/systemctl reload httpd

# ✅ GOOD: Specific user context
dba ALL=(postgres) /usr/bin/psql, /usr/bin/pg_dump

# ❌ BAD: Too broad
user ALL=(ALL:ALL) NOPASSWD: ALL

# ❌ BAD: Allows shell access
user ALL=(ALL) /bin/bash

Dangerous Configurations to Avoid

⚠ī¸ Security Anti-Patterns
# ❌ NEVER DO THIS: Allows privilege escalation
user ALL=(ALL) /bin/su
user ALL=(ALL) /usr/bin/su

# ❌ NEVER DO THIS: Allows changing root password
user ALL=(ALL) /usr/bin/passwd
# Instead, use:
user ALL=(ALL) /usr/bin/passwd [A-z]*, !/usr/bin/passwd root

# ❌ DANGEROUS: Editors can spawn shells
user ALL=(ALL) /usr/bin/vim
user ALL=(ALL) /usr/bin/emacs
# Instead, use:
user ALL=(ALL) NOEXEC: /usr/bin/vim /etc/specific/file

# ❌ DANGEROUS: Shell interpreters
user ALL=(ALL) /bin/bash
user ALL=(ALL) /usr/bin/python
user ALL=(ALL) /usr/bin/perl

# ❌ DANGEROUS: Programs that can execute arbitrary code
user ALL=(ALL) /usr/bin/find
user ALL=(ALL) /usr/bin/less
user ALL=(ALL) /usr/bin/more
user ALL=(ALL) /usr/bin/awk

Secure Configuration Guidelines

1. Use NOPASSWD Sparingly

# Only use NOPASSWD for:
# - Automated scripts that must run unattended
# - Very limited, safe commands
# - Commands that cannot cause damage

# ✅ ACCEPTABLE: Safe monitoring commands
nagios ALL=(ALL) NOPASSWD: /usr/bin/systemctl status *

# ✅ ACCEPTABLE: Safe reboot
operator ALL=(ALL) NOPASSWD: /sbin/reboot

# ❌ AVOID: Full access without password
user ALL=(ALL) NOPASSWD: ALL

2. Use Command Restrictions

# Restrict to specific service names
user ALL=(ALL) /usr/bin/systemctl restart httpd
user ALL=(ALL) /usr/bin/systemctl restart nginx

# Restrict file editing to specific paths
user ALL=(ALL) /usr/bin/vim /etc/httpd/conf.d/*.conf

# Use wildcards carefully and specifically
user ALL=(ALL) /usr/bin/systemctl status *
user ALL=(ALL) /usr/bin/systemctl restart web*

3. Implement Logging

# In /etc/sudoers or /etc/sudoers.d/logging
Defaults logfile="/var/log/sudo.log"
Defaults log_input, log_output
Defaults syslog=auth
Defaults syslog_goodpri=info
Defaults syslog_badpri=alert

# Log all commands for specific users
Defaults:admin log_input, log_output

# Send email on sudo violations
Defaults mailto="security@example.com"
Defaults mail_badpass
Defaults mail_no_user
Defaults mail_no_perms

4. Set Appropriate Timeouts

# Shorter timeout for sensitive systems
Defaults timestamp_timeout=5

# No caching for administrative users
Defaults:admin timestamp_timeout=0

# Longer timeout for development
Defaults:developers timestamp_timeout=30

# Global setting
Defaults timestamp_timeout=15

5. Restrict Environment Variables

# Reset environment for security
Defaults env_reset

# Keep only safe variables
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR \
                     LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                     LANG LC_ADDRESS LC_CTYPE"

# Remove dangerous variables
Defaults env_delete = "LD_LIBRARY_PATH LD_PRELOAD"

6. Use NOEXEC Where Appropriate

# Prevent spawning shells from these programs
user ALL=(ALL) NOEXEC: /usr/bin/less
user ALL=(ALL) NOEXEC: /usr/bin/vim
user ALL=(ALL) NOEXEC: /usr/bin/man

# Allow but restrict
user ALL=(ALL) NOEXEC: /usr/bin/find /var/log -name "*.log"

Auditing and Monitoring

# Review sudo logs regularly
sudo grep sudo /var/log/secure | tail -100    # Red Hat/CentOS
sudo grep sudo /var/log/auth.log | tail -100  # Debian/Ubuntu

# Check who has sudo access
sudo grep -r "" /etc/sudoers.d/
sudo cat /etc/sudoers | grep -v "^#" | grep -v "^$"

# List all users in wheel/sudo group
getent group wheel
getent group sudo

# Monitor failed sudo attempts
sudo grep "NOT in sudoers" /var/log/secure
sudo grep "incorrect password" /var/log/secure

# Check for syntax errors
sudo visudo -c
sudo visudo -c -f /etc/sudoers.d/*

# View sudo activity for specific user
sudo journalctl _COMM=sudo | grep "USER=username"

Regular Security Maintenance

✅ Security Checklist
  1. Review sudoers configurations quarterly
  2. Remove sudo access for departed employees immediately
  3. Audit sudo logs weekly for suspicious activity
  4. Test configurations in development before production
  5. Use centralized authentication (LDAP/AD) for large environments
  6. Implement two-person rule for critical systems
  7. Document all sudo policies and procedures
  8. Regular security awareness training for sudo users
  9. Keep sudo package updated
  10. Use version control for sudoers files

Compliance Considerations

For regulated environments (PCI-DSS, HIPAA, SOX), ensure:

  • All privileged access is logged and monitored
  • Logs are sent to centralized, tamper-proof logging system
  • Regular access reviews are documented
  • Separation of duties is enforced
  • Emergency access procedures are documented
  • Audit trails are retained per policy requirements

Troubleshooting

Common Issues and Solutions

Issue: "user is not in the sudoers file"

# Solution: Add user to sudoers
# As root or another sudo user:

# Method 1: Add to wheel/sudo group
sudo usermod -aG wheel username    # Red Hat/CentOS
sudo usermod -aG sudo username     # Debian/Ubuntu

# Method 2: Edit sudoers file
sudo visudo
# Add line:
username ALL=(ALL:ALL) ALL

# Verify
sudo -l -U username

Issue: "sudo: command not found"

# Solution: Install sudo
# As root (use su if necessary):
yum install sudo      # Red Hat/CentOS
apt install sudo      # Debian/Ubuntu
dnf install sudo      # Fedora
zypper install sudo   # SUSE

# Verify installation
which sudo
rpm -qa | grep sudo   # Red Hat-based
dpkg -l | grep sudo   # Debian-based

Issue: "Sorry, user username is not allowed to execute '/bin/command' as root"

# Solution: Grant specific permission
sudo visudo -f /etc/sudoers.d/username

# Add appropriate rule:
username ALL=(ALL) /bin/command

# Or check if command path is correct:
which command
# Then use full path in sudo rule

Issue: Syntax error in sudoers file - locked out

# Solution: Boot into single-user mode or recovery mode

# At GRUB menu, edit boot parameters:
# Add: init=/bin/bash

# Once booted:
mount -o remount,rw /
visudo -f /etc/sudoers
# Fix syntax error
# or
mv /etc/sudoers.d/problematic_file /tmp/

# Verify syntax
visudo -c

# Reboot
exec /sbin/init
⚠ī¸ Prevention is Key

ALWAYS use visudo to edit sudoers files. It checks syntax before saving and prevents lockouts.

Issue: "sudo: unable to resolve host hostname"

# Solution: Fix /etc/hosts
sudo vim /etc/hosts

# Ensure hostname is mapped
127.0.0.1   localhost
127.0.1.1   yourhostname

# Verify hostname
hostname
hostname -f

# Or set hostname properly
sudo hostnamectl set-hostname yourhostname

Issue: Password not being accepted

# Check if password authentication is disabled
sudo grep NOPASSWD /etc/sudoers /etc/sudoers.d/*

# Try refreshing credentials
sudo -k
sudo -v

# Check if user is in correct group
groups username
id username

# Verify PAM configuration
sudo vim /etc/pam.d/sudo

# Check for expired password
sudo passwd -S username

Issue: "sudo: command: command not found"

# Problem: secure_path doesn't include command location
# Solution: Find command and update secure_path

# Find command location
which command
whereis command

# Edit sudoers
sudo visudo
# Update Defaults secure_path to include directory:
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Or use full path in sudo command:
sudo /full/path/to/command

Issue: Environment variables not preserved

# Solution: Use -E option or configure env_keep
sudo -E command

# Or edit sudoers to keep specific variables
sudo visudo
Defaults env_keep += "HTTP_PROXY HTTPS_PROXY NO_PROXY"

# For specific user
Defaults:username env_keep += "PATH DISPLAY"

Debugging Tips

# Check what rules apply to user
sudo -l
sudo -l -U username

# Verbose listing
sudo -ll

# Verify sudoers syntax
sudo visudo -c
sudo visudo -c -f /etc/sudoers.d/*

# Check all sudoers files
sudo cat /etc/sudoers
sudo cat /etc/sudoers.d/*

# Check which groups user belongs to
groups username
id username

# Check recent sudo activity
sudo tail -100 /var/log/secure      # Red Hat/CentOS
sudo tail -100 /var/log/auth.log    # Debian/Ubuntu

# Check for failed attempts
sudo grep "authentication failure" /var/log/secure
sudo grep "NOT in sudoers" /var/log/secure

# Test as different user
sudo -i -u testuser
sudo whoami

Validation and Testing

# Test configuration changes safely
# 1. Keep a root shell open
sudo -i

# 2. Test in another terminal
sudo -l
sudo command

# 3. If locked out, use the root shell to fix

# Create test user for validation
sudo useradd -m testuser
sudo passwd testuser

# Test rules with test user
sudo -i -u testuser
sudo -l

# Remove test user when done
sudo userdel -r testuser

Getting Help

# Read manual pages
man sudo
man sudoers
man visudo
man sudo.conf

# Search for specific topics
man -k sudo

# Check installed version
sudo -V

# Online resources
info sudo

Quick Reference Summary

Essential Commands

Task Command
Run command as root sudo command
Get root shell sudo -i
Run as different user sudo -u username command
List privileges sudo -l
Edit sudoers safely sudo visudo
Check syntax sudo visudo -c
Refresh credentials sudo -v
Clear credentials sudo -k
View logs sudo tail /var/log/secure

Common sudoers Patterns

# Full access
%wheel ALL=(ALL:ALL) ALL

# Specific commands
user ALL=(ALL) /usr/bin/systemctl restart httpd

# No password
user ALL=(ALL) NOPASSWD: /sbin/reboot

# Run as specific user
webadmin ALL=(apache) ALL

# Command alias
Cmnd_Alias SERVICES = /usr/bin/systemctl start, /usr/bin/systemctl stop
%operators ALL=(ALL) SERVICES