- Alright, in this video,
we are going to explore some configuration options for sudo.
To start with, there is visudo.
Visudo is opening the /etc/sudoers configuration file
using the default editor.
And in this /etc/sudoers configuration file,
you can create whatever configuration you want.
Alternatively, you can use drop-in files
to the /etc/sudoers.d directory.
That's a generic approach that you will see a lot in Linux.
There's a generic configuration file
but this generic configuration file
is often managed by packages,
which means that if you update your system,
your generic configuration file might also get updated.
And that is why the drop-in directly can be a nice solution.
So the configuration file is corresponding directly.
Typically the name is etc, name of the file, .d,
you drop a file in there, and it will be considered as well.
And this is the kind of content
that you wanna have in your configuration file.
Like %wheel, ALL is ALL, ALL.
That is what on a RHEL based system enables sudo access
for all users that are a member of the group wheel.
There's also these other options.
So you will see it commented out
in the sudoers configuration file, wheel, ALL is ALL,
NOPASSWD:ALL, I am calling it the stupid option
because it grants members of the group wheel,
sudo superpowers without the need
to enter a password, and that's very dangerous.
So can you please never use that.
I do get a point why users want to use something like this
because if you use sudo, then there is a credentials cache.
How does it work?
Well, if you type sudo you are prompted
for a password at the moment that you prompt
your sudo enabled user password, a token is generated
and this token is valid for a few minutes only,
which means that if immediately
after you type a new sudo command, now you're okay.
But if 10 minutes later, you type new sudo command
you need to enter your password again.
I can get it that people think that is annoying.
And maybe you want to increase the validity
of your token a little bit.
You can do that by including the following line
in your sudoers configuration.
That is default timestamp type is global,
timestamp timeout is 240.
That will make your token valid for four hours
or the lifetime of your current session.
So what does that mean?
That means if you come to the office in the morning
you need to do many tasks as root
you enter your sudo password once,
you start working, you go have lunch,
you get back from lunch,
you need to enter your sudo password again
and it will be valid for the entire afternoon.
Entering a sudo password every four hours
to me sounds reasonable, entering the sudo password
every five minutes is annoying
and disabling the requirement of using passwords
at all, is just dangerous.
Let's go check out a couple of things
in the sudo configuration.
So to start it, I'm using visudo
and oh no, I'm getting permission denied.
Of course, I'm getting permission denied.
I'm running a command to change sudo configuration
so I need sudo visudo.
I'm being prompted for my password and here we can see
that I'm getting in the default editor
which is VI by the way, in CentOS.
The CentOS default file has many commands
to explain how to use it.
The most useful part is all the way down to the bottom.
What do we see all the way down to the bottom?
We see this include there
which is including the directory.
Here we see the line that is making sure
that members of the group wheel, can do everything.
And we also see another line.
I like this line and you know what?
I'm going to show you one small modification based
on what we see right here.
I am going to make sure that user Linda
on local host is allowed to use user/bin/passwd.
Just to show you that you can also use sudo privileges
to users to grant the user access
to one single command or a couple of commands.
Like user/sbin/useradd.
So user Linda can do user management, okay,
user/sbin/usermod for instance,
three commands for user Linda.
Oh, and also I wanna take care of this authentication token.
So I'm adding defaults followed by,
timestamp,
timestamp_type is global
and timestamp_timeout
is 240.
And in case you are thinking, hey Sandy, you make a typo.
I do that on purpose
because I want to show you what's happening.
So what do do we see?
We see, oh no, oh no.
Default entry, timestamp, timeout, visudo makes sure
that you cannot make any typos in your configuration file.
You get a warning if that is happening.
So it's asking what now, and I don't know what now.
So I just enter the question mark
and then it's telling me which options I've got.
Well, my option is to use e for edit.
There we go, e for edit.
And now I get back to the line that I last edited
and I'm adding the u.
If you use uppercase D to go to the bottom of the line
we still can see user Linda.
So that is good.
Now the sudo configuration has changed.
Now let's test, let's test this user Linda abilities.
So I'm using sudo passwd on Linda, I never set a password
for user Linda and user root can set passwords.
So in order to do that I first need
to enter my own password and then I can enter
the password for user Linda.
It's complaining that it's a bad password.
I don't care about it.
I like using this password, so here we go.
Now I need to test, how am I going to test?
By opening a cell as user Linda, look at that,
su minus Linda.
We'll open a sub cell as user Linda.
So I don't need to log out or anything
at this point, I have a cell in which I am user Linda
and user Linda is going to use sudo passwd.
Now let's do sudo useradd, Bob
and user Linda is entering the password
and oh, boy, what do we get?
We get, Linda is not allowed to run sudo on CentOS.
This incident will be reported.
What is going on?
Well, we need to investigate
and we need to investigate by doing our sudo visudo again.
And what I don't like about this Linda line,
I don't like the location where we've got it.
So I'm going to move it from the current location
just by deleting it in VI, you can do that.
And I'm going to move it up a little bit.
Here we go, I'm pasting it.
And we are going to try it again.
Also, I'm going to change local host.
Now that I'm here anyway, I want to change local hosts
to all I don't care where user Linda is coming
from, from all hosts she should be able
to run these commands.
And now just to make sure,
we should verify which passwd, user/bin/passwd,
that's alright, which useradd, user/sbin/useradd.
That's alright as well.
And which usermod, user/sbin/usermod.
In sudo you need to be specific about the path.
Now, let me open this user Linda cell again,
su minus Linda.
There we go.
I'm typing, who am I?
And I can see I'm user Linda.
So sudo useradd Bob, is it working now?
Well, let me enter the password and now it is working.
What did we just learn?
We just learnt that in the sudo configuration
you cannot have any additional configuration below the line
that includes the etc/sudoers.d.
Let's do sudo passwd, I'm still user Linda.
So sudo passwd, Bob and I am going to set this password
for user Bob.
That's successful.
Now have a look at the following, sudo passwd root.
Changing password for user root, fails the dictionary check
and oh no, Linda just edited the password for user root.
We need to do something about it.
Can we?
Yes, we can.
How are we going to do that?
Well, I am getting back
to my visudo and what am I going to do?
I am going to include one more option.
And that is the option where I'm specifying not,
exclamation mark is for not, not user/bin/passwd root.
That's how I want to do it.
So, Linda can run the passwd command
but not user/passwd root.
And then we have this user/sbin/useradd and so on,
and that is alright.
Now, let me get back
to the Linda cell, su Linda, there we go.
And in the Linda cell I am going to use sudo/passwd root
and uh-oh, Linda is not allowed to execute bin/passwd root
as root on CentOS.
How about sudo passwd, Bob?
Changing password for user Bob.
So in sudo, if you are going to work with sudo
if you are going to create help desk kind of people,
make sure you configure this exclusion
so that the user is not capable
of setting the password for the root user.
And that is how you work with sudo.