/etc/sudoers vs /etc/sudoers.d/ file for enabling sudo for a user

Question

I am using Yocto to build image for a board. I have disable the root user. I am adding a new user, lets say adminuser1. As it looks to me there are two options to make adminuser1 as admin.

• Add adminuser1 to sudoers in /etc/sudoers
• Create a new file /etc/sudoers.d/0001_admin1 and add a line adminuser1 ALL=(ALL) ALL

The default /etc/sudoers has the sudo group commented # %sudo ALL=(ALL) ALL

I am trying to understand, as to which one is a better approach in terms of security:

• Shall I add adminuser1 to sudo group and uncomment the # %sudo ALL=(ALL) ALL in /etc/sudoers
• Adding /etc/sudoers.d/0001_admin1 and adding only adminuser1 ALL=(ALL) ALL in the file.

Answer 1

The choice between sudoers and sudoers.d has nothing to do with security, but everything with maintainability.

• By uncommenting the sudo group line in /etc/sudoers, you can add all users that need to have sudo access to the sudo group. This may or may not be easier to do than adding a new file in sudoers.d, depending on your setup. However, changing the shipped configuration file may make things harder (e.g., if there is an update of your distribution which would overwrite the sudoers file, you have to ensure that your change is retained).
• By adding a file to /etc/sudoers.d, you don't have the update issue that I hint to above, but then if you there explicitly add configuration for adminuser1 rather than the sudo group, adding more users to have sudo rights will require more files to be added to /etc/sudoers.d; this may or may not be more involved than just adding them to the right group.

There is no one way which is "best"; and there certainly isn't a security issue based on "which file do I configure sudo rights in". Just consider the upsides and/or downsides of both methods, and use whichever works best for your use case.

Answer 2

From Wikipedia:

the principle of least privilege (also known as the principle of minimal privilege or the principle of least authority) requires that in a particular abstraction layer of a computing environment, every module (such as a process, a user, or a program, depending on the subject) must be able to access only the information and resources that are necessary for its legitimate purpose.

This means that the option 2 is the best one because you can tailor the permission of your adminuser1. With option 1, when in the future you will add adminuser2 to the sudo group, then they will have the same privileges which don't let you tailor the privileges the two users.

Moreover, always use visudo to edit the sudoers file.

HTH