06-18-2011
Why edit groups into sudoers instead of adding users to groups? Let the login system do the legwork.
10 More Discussions You Might Find Interesting
1. Cybersecurity
Hi,
Is it possible that one user belongs to many groups, or the relation of user/group is 1/1?. Thanks
Ramón (2 Replies)
Discussion started by: rsanz
2 Replies
2. Linux
RH 7.2
I'm trying to list the users & groups on my machine. I found the lsuser & lsgroup commands but no associated man pages.
I typed: lsuser
I get --> Valid options are: -a
So I typed: lsuser -a
I get --> Valid options are: groups, home
So I typed: lsuser -a groups
I get -->... (2 Replies)
Discussion started by: jalburger
2 Replies
3. UNIX for Dummies Questions & Answers
hi eveyone i've recently requested my unix admin to create a userid for 2 groups. He created the id and i can see it by grep "id" /etc/group.
But when i login with that id into unix and try to cd that group it says permission denied. something like cd /groupname -- permission denied
Can my admin... (1 Reply)
Discussion started by: sammet
1 Replies
4. Shell Programming and Scripting
I'm trying to create a script to remove users from sudoers on multiple servers. I'm able to do this with a one-line script using sed, but only if it's on one server.
Example: sed '/someuser/d' /host/local/etc/sudoers
Also, I think the problem with this one-line script is that I would have to... (4 Replies)
Discussion started by: em23
4 Replies
5. Solaris
Hello gurus,
I've been working on a sudoers file to work with groups in LDAP. I've created the groups in LDAP and added the users to there respective groups. I've also setup my sudoers file to have the groups match what is in LDAP. And I've added ldap to nsswitch.conf in the group line. The... (6 Replies)
Discussion started by: em23
6 Replies
6. Shell Programming and Scripting
Hello,
I am new to Unix and shell scripting. I am trying to find unowned files and groups on my servers. I know, i could use the below command to find it on individual server.
#find / -nouser -o -nogroup -print
But I was wondering, if someone could help with a shell script so that I can... (2 Replies)
Discussion started by: ut916
2 Replies
7. Shell Programming and Scripting
Dear All,
I want to know all users & group history in one file, for root terminal through shell or any other option (5 Replies)
Discussion started by: kpoobathi
5 Replies
8. Shell Programming and Scripting
Hi all. I need a shell script that can, in short, read through a text file line by line and create a new user in Ubuntu, as well as assign that user to a group. The format of the text file is not important but preferably: 'username:group'. I don't have much programming knowledge no matter shell... (3 Replies)
Discussion started by: LewisWeekly
3 Replies
9. Red Hat
All,
I need to disable "sudo -i" and "su - " for all servers in our environment, We want to make sure no one run commands or delete files across environment using switching to root account. can you guys please lets me know if this is achievable.
Thanks and Regards
shekar (2 Replies)
Discussion started by: shekar777
2 Replies
10. UNIX for Beginners Questions & Answers
Hi Team,
I got a requirement to send a mail to the individual users of a unix server about their respective groups. can some one help me to provide the script as I am unable to write that.
I tried with below lines but I come out with errors.
cat /etc/passwd | awk -F':' '{ print $1}' |... (6 Replies)
Discussion started by: harshabag
6 Replies
LEARN ABOUT LINUX
sudo_root
sudo_root(8) System Manager's Manual sudo_root(8)
NAME
sudo_root - How to run administrative commands
SYNOPSIS
sudo command
sudo -i
INTRODUCTION
By default, the password for the user "root" (the system administrator) is locked. This means you cannot login as root or use su. Instead,
the installer will set up sudo to allow the user that is created during install to run all administrative commands.
This means that in the terminal you can use sudo for commands that require root privileges. All programs in the menu will use a graphical
sudo to prompt for a password. When sudo asks for a password, it needs your password, this means that a root password is not needed.
To run a command which requires root privileges in a terminal, simply prepend sudo in front of it. To get an interactive root shell, use
sudo -i.
ALLOWING OTHER USERS TO RUN SUDO
By default, only the user who installed the system is permitted to run sudo. To add more administrators, i. e. users who can run sudo, you
have to add these users to the group 'admin' by doing one of the following steps:
* In a shell, do
sudo adduser username admin
* Use the graphical "Users & Groups" program in the "System settings" menu to add the new user to the admin group.
BENEFITS OF USING SUDO
The benefits of leaving root disabled by default include the following:
* Users do not have to remember an extra password, which they are likely to forget.
* The installer is able to ask fewer questions.
* It avoids the "I can do anything" interactive login by default - you will be prompted for a password before major changes can happen,
which should make you think about the consequences of what you are doing.
* Sudo adds a log entry of the command(s) run (in /var/log/auth.log).
* Every attacker trying to brute-force their way into your box will know it has an account named root and will try that first. What they do
not know is what the usernames of your other users are.
* Allows easy transfer for admin rights, in a short term or long term period, by adding and removing users from the admin group, while not
compromising the root account.
* sudo can be set up with a much more fine-grained security policy.
* On systems with more than one administrator using sudo avoids sharing a password amongst them.
DOWNSIDES OF USING SUDO
Although for desktops the benefits of using sudo are great, there are possible issues which need to be noted:
* Redirecting the output of commands run with sudo can be confusing at first. For instance consider
sudo ls > /root/somefile
will not work since it is the shell that tries to write to that file. You can use
ls | sudo tee /root/somefile
to get the behaviour you want.
* In a lot of office environments the ONLY local user on a system is root. All other users are imported using NSS techniques such as
nss-ldap. To setup a workstation, or fix it, in the case of a network failure where nss-ldap is broken, root is required. This tends to
leave the system unusable. An extra local user, or an enabled root password is needed here.
GOING BACK TO A TRADITIONAL ROOT ACCOUNT
This is not recommended!
To enable the root account (i.e. set a password) use:
sudo passwd root
Afterwards, edit the sudo configuration with sudo visudo and comment out the line
%admin ALL=(ALL) ALL
to disable sudo access to members of the admin group.
SEE ALSO
sudo(8), https://wiki.ubuntu.com/RootSudo
February 8, 2006 sudo_root(8)