sudoers

Anatomy of a sudoers rule

The sudoers manual describes a rule as "who where = (as_whom) what". For example:

alan ALL = (root, bin : operator, system) ALL
ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm

A user is a name, #uid for a numeric ID, or %group for a group. ALL is a reserved word that always matches. Commands are fully qualified file names, and the NOPASSWD and PASSWD tags set a default for the commands that follow them.

Aliases keep rules readable. There are four types: User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias. Names use uppercase letters, digits and underscores and must start with an uppercase letter, and redefining an alias is a syntax error.

User_Alias WEBTEAM = alice, bob
Cmnd_Alias NGINXCTL = /usr/bin/systemctl reload nginx, /usr/bin/systemctl restart nginx
WEBTEAM ALL = (root) NGINXCTL

Order matters: sudo applies entries in sequence and the last match wins, which, the manual stresses, is not necessarily the most specific match. Put broad rules first and exceptions after them.

/etc/sudoers.d and the file name trap

Many distributions ship a main file that pulls in a directory with @includedir /etc/sudoers.d. That is the right place for your own rules, one file per purpose, so package upgrades never overwrite them. The manual states two rules for the directory:

• Files whose names end in ~ or contain a . are skipped. A file called 90-deploy.conf is silently ignored, so use names like 90-deploy.
• Files are read in sorted lexical order, not version order, so 1_whoops loads after 10_second. Use consistent leading zeros, because a later file can override an earlier one.

Create and check files with visudo, which locks the file, parses it and refuses to save on a syntax error:

sudo visudo -f /etc/sudoers.d/90-deploy
sudo visudo -c
sudo visudo -cf /etc/sudoers.d/90-deploy

The visudo manual says -c checks the file and its includes, and also ownership and permissions when no path is given. It exits 0 on success and 1 on error. If the prompt offers Q (quit and save), do not use it, since sudo will reject the file too.

A narrow rule, and how to test it

A safe rule names one account, one target user and one exact command. This lets a deployment account restart one service without a password and nothing else:

deploy ALL = (root) NOPASSWD: /usr/bin/systemctl restart myapp

Test it from both sides. As an administrator, list what the account may do. As that account, clear any cached credentials with -k and run the command non-interactively with -n, which fails instead of prompting if a password would be needed:

sudo -l -U deploy
sudo -k; sudo -n systemctl restart myapp
sudo -n systemctl status myapp

The last command should be refused, which proves the rule is not broader than intended. Per the sudo manual, -U lists another user's privileges and is restricted to root and users with suitable permission.

Avoid shortcuts the manual warns about. Subtracting commands from ALL with ! is "generally not effective", and a user with ALL can create their own program. Wildcards in arguments can match whitespace and slashes. Editors and pagers allow shell escapes unless you add NOEXEC, or better, use sudoedit.

Defaults and where sudoers fits in hardening

Defaults lines change sudo's behaviour globally or per user, host or command. The manual lists these built-in values:

• env_reset is on by default and runs commands in a minimal environment.
• timestamp_timeout defaults to 5 minutes, and 0 means always prompt.
• use_pty is on by default for sudo 1.9.14 and above.
• secure_path is disabled by default, although your distribution may set it.

sudoers controls privilege only for people who already have an account. It is separate from UID 0, because an account with UID 0 already has full privileges regardless of sudo configuration. Pair it with disabled root login, key-based SSH from the SSH hardening guide, and the account audit in the users, sudo and least privilege guide, which also covers keeping sudo patched.

Review /etc/sudoers.d on a schedule. Every file there is a standing grant of privilege, and the /etc/passwd accounts it names should still exist and still be needed.

Related terms: Least privilege, UID 0, /etc/passwd, Root login, Two-factor authentication, sudo.