what are the unforseen consequences to using visudo to enable wheel group to run all sudo commands?

Question

On CentOS release 5.11 (Final) I created a user and added them to the wheel group with usermod but when I look in the sudoers file at /etc/sudoers the relevant line is commented out. Looking at groups:

[root@arrakis ~]# 
[root@arrakis ~]# grep wheel /etc/group
wheel:x:10:root,hawat
[root@arrakis ~]# 
[root@arrakis ~]# su hawat
[hawat@arrakis root]$ 
[hawat@arrakis root]$ cd
[hawat@arrakis ~]$ 
[hawat@arrakis ~]$ whoami
hawat
[hawat@arrakis ~]$ 
[hawat@arrakis ~]$ sudo echo "hello sudo"
[sudo] password for hawat: 
hawat is not in the sudoers file.  This incident will be reported.
[hawat@arrakis ~]$ 

and

[root@arrakis ~]# 
[root@arrakis ~]# groups wheel ; getent passwd hawat
id: wheel: No such user
hawat:x:505:505::/home/hawat:/bin/bash
[root@arrakis ~]# 

Taking a closer look at sudoers:

[root@arrakis ~]# 
[root@arrakis ~]# grep wheel /etc/sudoers
## Allows people in group wheel to run all commands
# %wheel    ALL=(ALL)   ALL
# %wheel    ALL=(ALL)   NOPASSWD: ALL
[root@arrakis ~]# 

I hesitate to uncomment those lines so that the wheel group can run all commands with sudo. This is an Elastix 2.5 system on CentOS; perhaps there's a reason not to have wheel in the sudo list?

Should I just go ahead an manually edit sudoers with visudo?

Answer 1

Certainly, uncommenting the line %wheel ALL=(ALL) ALL with visudo allows, apparently, sudo to work correctly. Emphasis on apparently. Again, this is Elastix 2.5 on CentOS, neither of which are familiar. If this is "ok" then that would be the answer to the question. The sudoers file:

[root@arrakis ~]# 
[root@arrakis ~]# grep wheel /etc/sudoers
## Allows people in group wheel to run all commands
 %wheel ALL=(ALL)   ALL
# %wheel    ALL=(ALL)   NOPASSWD: ALL
[root@arrakis ~]# 

Now that the wheel group is enabled, apparent success:

[root@arrakis ~]# 
[root@arrakis ~]# su hawat
[hawat@arrakis root]$ 
[hawat@arrakis root]$ cd
[hawat@arrakis ~]$ 
[hawat@arrakis ~]$ sudo echo "foo"
[sudo] password for hawat: 
foo
[hawat@arrakis ~]$ 

Are there alternate solutions? Does this negatively impact security, the OS or Elastix in some way? I don't know the answer to those questions.