Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

suppose mymachine:/etc/sudoers includes the line

joe  someremotehost = (ALL) NOPASSWD: ALL

but someremotehost:/etc/sudoers does not say anything special about joe, then what effect does the above line have?

share|improve this question

In its default configuration, sudo looks in the sudoers file on the local machine (i.e., on the machine upon which it is invoked) to determine what to do - it doesn't contact another host to find out what it would permit, so in this case, the joe someremotehost line on your local machine would not affect the operation of sudo on someremotehost. And since it specifies a hostname restriction, sudo on your local machine would ignore the rule, because the hostname in the config doesn't match the hostname sudo gets from the C library.

The sudoers file syntax allows you to specify hostname restrictions so that managing policy for a large group of hosts is as easy as editing the file in one place, and then pushing it out to all hosts in the administrative domain.

share|improve this answer
Best to keep /etc/sudoers untouched (don't mess up root) and push-sync a central config folder to /etc/sudoers.d/ on every machine, right? – arney Apr 8 '13 at 19:52
That would mean that keeping the ALL instead of a specific host name makes the sudoers no less secure, if only employed locally on one box, right? – humanityANDpeace May 3 at 6:27

Effectively nothing. The file on the remote host is never consulted, but the local file only gives permission on the other host, not on this host.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.