2

I am working on standardizing the sudo access in our environment. To begin with, I am understanding the current setup.

Currently, we use sudo bash to get into the root shell without typing any passwords. I understand that giving sudo access on individual commands is recommended but at least for now, I wanted a mechanism where we type our password and then get a root shell.

To re-iterate, sudo bash or sudo -s works fine but when I typed sudo su -, it prompted for my password and once I typed it, it gave me a message '*Sorry, user <username> is not allowed to execute '/bin/su -' as root on lt;server name>'. This got me curious to see how is sudo bash working.

In /etc/sudoers file, I see two lines relevant in this context:

        root    ALL=(ALL)   ALL
        %wheel  ALL=(ALL)   ALL

And I am not part of the %wheel group. admin is my default group in /etc/passwd and admin group isn't part of wheel group in /etc/group. So, to make sudo su - to work, I added below line to the sudoers file and it worked.

        %admin  ALL=(ALL)   ALL

But I am not able to understand:

  • How is sudo bash working for everyone?
  • Is everyone part of the wheel group by default?

Please let me know if I am missing something here. Also, if there are better ways to do things.

OS: CentOS 7.2 (Red Hat family)


It turns out there are certain files in /etc/sudoers.d and that's how sudo bash was working but i thought it was commented out... Thanks.

#includedir /etc/sudoers.d
  • 1
    Are there any other configs included at the end of the sudoers file? – Kusalananda Aug 25 '17 at 11:50
  • Ah right.. there are certain files in /etc/sudoers.d and that's how 'sudo bash' was working but i thought it was commented out... Thanks. #includedir /etc/sudoers.d From the sudoers man page: – Ram Kumar Aug 25 '17 at 11:51
  • And what's the recommended way to give full root access to sysadmins? (or if you want to say less harmful and audited way) – Ram Kumar Aug 25 '17 at 11:53
2

Answer assembled from comments:

The issue of why sudo bash was working for someone not in the wheel group was resolved through the realization that the main sudoers configuration file was including further configuration files from /etc/sudoers.d (and one of these files allowed this to happen).

And yes, the # at the start of #include is confusing.

A further question regarding how to safely give super-user rights to system administrators was answered by referring to the old question "Which is the safest way to get root privileges: sudo, su or login?". As is evident from the answers to that question, it is not a matter that is straight forward.

Also related: "Is there ever a good reason to run sudo su?"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.