🔑 sudo & Privileges

# Run a single command as root
sudo dnf update
sudo systemctl restart nginx
sudo vi /etc/hosts

# Run as a specific user (not root)
sudo -u postgres psql
sudo -u www-data php artisan migrate

# Get an interactive root shell
sudo -i          # login shell — loads root's environment
sudo -s          # non-login shell — keeps current environment
sudo su -        # equivalent to sudo -i

# Run a command with root's environment
sudo -H vi /etc/nginx/nginx.conf

# List what sudo you are allowed to run
sudo -l
sudo -l -U alice   # check another user's sudo rights (as root)

# Reset sudo timestamp (re-prompt for password next time)
sudo -k

# Extend sudo timeout without running a command
sudo -v

# ALWAYS use visudo — never edit /etc/sudoers directly
sudo visudo

# visudo validates syntax before saving
# A syntax error in /etc/sudoers can lock out all sudo access

# Edit a specific drop-in file (preferred method)
sudo visudo -f /etc/sudoers.d/webteam

# Check syntax of a sudoers file without applying
sudo visudo -c -f /etc/sudoers.d/webteam

# List all sudoers files
ls -la /etc/sudoers.d/

# /etc/sudoers.d/admins — full admin access
%wheel  ALL=(ALL)  ALL
%admins ALL=(ALL)  ALL

# /etc/sudoers.d/webteam — web team, specific commands only
%webteam ALL=(root) NOPASSWD: \
    /usr/bin/systemctl restart nginx, \
    /usr/bin/systemctl reload nginx, \
    /usr/bin/systemctl status nginx

# /etc/sudoers.d/dbadmins — database team
%dbadmins ALL=(root) NOPASSWD: \
    /usr/bin/systemctl restart postgresql, \
    /usr/bin/systemctl restart mysqld
%dbadmins ALL=(postgres) NOPASSWD: /usr/bin/psql

# /etc/sudoers.d/monitoring — read-only monitoring
monitoring ALL=(root) NOPASSWD: \
    /usr/bin/journalctl, \
    /usr/bin/ss, \
    /usr/bin/df, \
    /usr/bin/top, \
    /usr/bin/ps

# Allow a user to edit specific files with sudoedit
alice ALL=(root) sudoedit /etc/nginx/conf.d/*.conf

# Command alias — group commands under a name
Cmnd_Alias SERVICES = /usr/bin/systemctl start *, \
                      /usr/bin/systemctl stop *, \
                      /usr/bin/systemctl restart *
%sysadmin ALL=(root) SERVICES

### RHEL / Rocky / AlmaLinux — uses wheel group ###

# Add user to wheel group
sudo usermod -aG wheel alice

# Verify wheel is enabled in sudoers (should be uncommented)
grep wheel /etc/sudoers
# Should show: %wheel  ALL=(ALL)  ALL

# Remove from wheel group
sudo gpasswd -d alice wheel


### Debian / Ubuntu — uses sudo group ###

# Add user to sudo group
sudo usermod -aG sudo alice

# Verify
grep sudo /etc/sudoers
# Should show: %sudo  ALL=(ALL:ALL)  ALL

# On either system — verify user's sudo access
sudo -l -U alice
su - alice -c "sudo -l"

# Every sudo command is logged — view with journalctl
sudo journalctl -t sudo
sudo journalctl -t sudo --since today
sudo journalctl -t sudo -n 50

# On systems with /var/log/secure or /var/log/auth.log
sudo grep sudo /var/log/secure | tail -20         # RHEL
sudo grep sudo /var/log/auth.log | tail -20       # Debian/Ubuntu

# See who ran what sudo commands
sudo journalctl -t sudo | grep "COMMAND" | tail -20

# Enhanced logging — add to sudoers for detailed logs
sudo visudo
# Add these lines:
# Defaults  logfile=/var/log/sudo.log
# Defaults  log_input, log_output
# Defaults  iolog_dir=/var/log/sudo-io/%{user}

sudoedit (or sudo -e) lets a user edit a privileged file safely — it copies the file to a temp location, opens it in the user's own editor, then copies it back. No root shell involved:

# User edits /etc/nginx/nginx.conf without getting a root shell
sudoedit /etc/nginx/nginx.conf
sudo -e /etc/nginx/nginx.conf    # same thing

# Grant sudoedit permission in sudoers (safer than NOPASSWD: /usr/bin/vi)
# In /etc/sudoers.d/webteam:
# alice ALL=(root) sudoedit /etc/nginx/conf.d/*.conf

# sudoedit respects the user's EDITOR/VISUAL environment variable
export EDITOR=vim
sudoedit /etc/hosts

# Useful Defaults settings to add to sudoers
sudo visudo

# Require password re-entry after 5 minutes (default is 15)
Defaults  timestamp_timeout=5

# Require password even for NOPASSWD commands when session is new
Defaults  timestamp_type=tty

# Log all sudo commands to a dedicated file
Defaults  logfile=/var/log/sudo.log

# Send mail on sudo failures (bad password etc.)
Defaults  mailto=sysadmin@example.com
Defaults  mail_badpass

# Prevent environment variable injection attacks
Defaults  env_reset
Defaults  env_keep += "LANG LC_ALL LC_MESSAGES LC_CTYPE LC_COLLATE LC_TIME"

# Secure PATH — use only known-good directories
Defaults  secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Show a lecture to new sudo users
Defaults  lecture=always
Defaults  lecture_file=/etc/sudo_lecture

# su — switch user (requires target user's password)
su alice               # switch to alice, keep environment
su - alice             # switch to alice, load her full environment
su -                   # switch to root (requires root password)

# sudo su — use sudo to become another user without their password
sudo su - alice        # become alice (requires YOUR sudo password)
sudo -u alice -i       # equivalent — open alice's login shell
sudo -u postgres psql  # run a command as postgres user

# runuser — run a command as another user (root only, no PAM)
sudo runuser -l postgres -c "pg_dump mydb > /backup/mydb.sql"
sudo runuser -u www-data -- php artisan queue:work

# Check who you are after switching
id
whoami

# Exit back to original user
exit    # or Ctrl-D