I have been adding lines similar to this to a file in
%mygroupname ALL=(ALL) NOPASSWD: /sbin/mount, /sbin/umount
However, I believe that can be improved upon. For example, I am considering this version:
%mygroupname host9=(%wheel) NOPASSWD: /sbin/mount, /sbin/umount
The commands listed are just examples. In actual use these may be custom scripts or system commands.
My intention here, if I understand this correctly, is to allow members of mygroupname to execute mount and umount only on the specific host9 machine and to further prevent execution from being runas "ALL". Do I gain anything from these extra steps? I'm especially interested in how to leverage the runas list so that commands cannot be runas ALL.
My thought is that if the runas limitation is not defined or is defined as ALL, that opens up more potential security holes than if a more limited runas definition is used. I am considering creating a user or group with specific priviledges for this purpose, but some of the commands being run in scripts require sudo rights. Do I gain anything from this extra effort? Any suggestions regarding best practices are appreciated.
My specific question is how to properly define the runas list to tighten security on these priviledged commands that ordinary users are allowed to run.