2

I have a user, say userX on a Centos7 machine. I have removed all the groups from this user and this user is now assigned only to the group userX. However, I am still able to use sudo su and become root.

Sequence of commands:
1. SSH in as normal user sriram.
2. sudo to userX: sudo su - userX.
3. Become root: sudo su. This is allowed without password etc. The ideal behavior would be that userX would not be allowed to become root.

Running: sudo -lU userX:

[sudo] password for sriram:
Matching Defaults entries for userX on this host:
    requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS",
    env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT
    LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS
    _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, timestamp_timeout=0

User userX may run the following commands on this host:
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL

Where could I be going wrong? What additional information is required from me?

  • group status doesn't update until the next login session. This works both ways. – Shadur Mar 14 '16 at 6:15
  • logged out and logged back in multiple times after making the changes. the issue still remains. – Sriram Mar 14 '16 at 6:29
  • Did you change the sudoers file also? – tachomi Mar 14 '16 at 6:43
  • I did, but I left this user alone. I added a couple of rules for new groups that allowed them some control over Apache and mounting, unmounting. – Sriram Mar 14 '16 at 6:48
  • 1
    @muru: Nope. That is the only line I found. I ran the sudo -lU command again after commenting that line out. I now get that userX is no longer allowed to run sudo. Why don't you write this as your answer and I will accept it? – Sriram Mar 14 '16 at 7:13
5

When troubleshooting sudo access, sudo -l is very useful. sudo -l prints your sudo privileges, and sudo -lU user prints that user's sudo privileges (if you have all privileges).

$ sudo -l
User muru may run the following commands on laptop:
    (ALL) ALL

sudo prints a line for each matched rule, specifying the granted privilege, but not the matching criteria.

For example, with the following three rules in three different files:

%wheel ALL = (ALL) ALL
muru ALL = (ALL:ALL) ALL
%muru ALL = (ALL) ALL

The output could be:

# sudo -lU muru
User muru may run the following commands on laptop:
    (ALL) ALL
    (ALL) ALL
    (ALL : ALL) ALL

What you can do is look for rules that grant these privileges, and check how the target user can match them. Each line should correspond to a rule that sudo matched with this user, so, if there are three lines, there should be three rules (unless your sudo configuration is weird and reads the same file twice or something).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.