Why doesn't the sudo command need the root password?

Question

I've been using Linux for a while now and whenever I typed sudo I thought I was switching over to the root user for a command.

Apparently this is not true because all I need is my user account's password. I'm guessing since I haven't worked with multiple users I haven't really noticed this in the real world.

I am unsure how Ubuntu sets up my first account. Is there a root user? Am I root? I'm guessing I just created a new user upon installation but it gave me root privileges? Just a little confused here...

So why am I allowed to run root commands with my user's password?

Answer 1

In details it works the following way:

1. /usr/bin/sudo executable file has setuid bit set, so even when executed by another user, it runs with the file owner's user id (root in that case).

2. sudo checks in /etc/sudoers file what privileges do you have and whether you are permitted to run the command you are invoking. Saying simply, /etc/sudoers is a file which defines which users can run which commands using sudo mechanism.

   That's how that file look on my Ubuntu:

   # User privilege specification
   root    ALL=(ALL:ALL) ALL
   
   # Members of the admin group may gain root privileges
   %admin ALL=(ALL) ALL
   
   # Allow members of group sudo to execute any command
   %sudo   ALL=(ALL:ALL) ALL
   

   The third line is what presumably interests you. It lets anybody in the "sudo" group to execute any command as any user.

   When Ubuntu sets up the first account during installation it add that account to the "sudo" group. You can check which groups which users belong to with group command.

3. sudo asks you for a password. Regarding the fact that it needs user's password, not the root's one, that is an excerpt from sudoers manual:

   Authentication and logging

   The sudoers security policy requires that most users authenticate themselves before they can use sudo. A password is not required if the invoking user is root, if the target user is the same as the invoking user, or if the policy has disabled authentication for the user or command. Unlike su(1), when sudoers requires authentication, it validates the invoking user's credentials, not the target user's (or root's) credentials. This can be changed via the rootpw, targetpw and runaspw flags, described later.

   However, in fact, sudo does not need your user password for anything. It ask for it just to ensure that you are really you and to provide you some kind of warning (or chance to stop) before invoking some potentially dangerous command. If you want to turn off password asking, change the sudoers entry to:

   %sudo   ALL=(ALL:ALL) NOPASSWD: ALL
   

4. After authentication sudo spawns child process which run the invoked command. The child inherits the root user id from its parent -- the sudo process.

---

So, answering your questions precisely:

I thought I was switching over to the root user for a command.

You were right. Each command preceded with sudo runs with the root user id.

Is there a root user?

Yes, there is a root user account, separate from your user account created during system installation. However, by default in Ubuntu you are not allowed to login to interactive terminal as root user.

Am I root?

No, you are not a root. You only have privilege to run individual commands as a root, using the sudo mechanism described above.

So why am I allowed to run root commands with my user's password?

You have to enter user's password only due to sudo internal security mechanism. It can be easily turned off. You gain your root powers because of setuid bit of /usr/bin/sudo, not because of any passwords you enter.

Answer 2

• The whole point of sudo is to grant you someone else's privileges (usually root) without asking for this other account's password (unlike su).

• sudo is asking here for your password just to make sure a passer-by won't misuse your unlocked terminal.

• Ubuntu and many other Linux and Unix OSes are granting an initial account created at installation time the right to run any commands as root.

• While root is still an account under Linux, direct root logins are disabled by default for a better security and traceability.

Answer 3

Piotr gave a very good explanation of how sudo works. However, he didn't really motivate why it works this way, so I'll try to add that here.

Before the sudo command was created, we had the su command. This command allows one user to execute commands as another user, usually root (as with sudo, this is the default target user). It was totally undiscriminating, you can execute any command. Since it could be used by any user, was effectively equivalent to logging in as that user, it required you to know the target user's password.

At some point, a little more access control was added: to use su, you had to be a member of the wheel group. But since you still could execute any command, it still made sense to require you to know their password.

Requiring users to know each other's, or the superuser's, password was not very secure, though. Often you just want to give certain users limited access to some other account (this is part of a security concept called the principle of least privilege). It also makes accountability difficult: if multiple people know an account's password, and that account is involved in a mistake or abuse, you can't tell which of them actually did it.

So sudo was created. Rather than allowing users to execute any command, it has an elaborate configuration file, briefly touched on in Piotr's answer, that specifies precisely who may use it, what users they can switch to, and what commands they're allowed to run. With this fine-grained control over who can do what to whom, we no longer need to give users the target account's password; if we did, they could easily bypass all the controls in the configuration file by logging in as that user. Instead, we normally just require them to prove that they are who they logged in as, by entering their own password -- this is intended to prevent someone from taking advantage of an account if the terminal is left unattended.

This requirement is waived for the superuser -- this account can do almost anything to the system without using sudo, so it was deemed superfluous. It's also possible to specify in the configuration file that users don't have to enter a password at all -- some organizations use this when they believe the physical security of their workstation environment is sufficient to prevent abuse.

Answer 4

The answer to your question is:

When you run a command with sudo, you run the command with elevated priviliges, that is root priviliges. You only have to type your normal user password because you (the user) has been added to sudoers file which gives you root priviliges.

Answer 5

First, disabling an account is usually done by setting the encrypted password to *, which is not the encrypted value of any string. I can't check right now, but I believe that's what Ubuntu does for root as well. So technically, there is no root password on Ubuntu.

But sudo precedes Ubuntu; it was designed for systems where there certainly were root passwords. So why doesn't it require the root password? Basically, sudo is designed to give permission to run specific commands to certain users --- e.g., allow a developer root access to re-start the web application, but not to start arbitrary servers. Knowing the root password, on the other hand, gives you unlimited access; you can use login or su to open a root shell and run arbitrary commands. Since sudo has to work for people without that level of access, it can't require the root password to run.