0

I am trying to understand the sudoers file, but I have a few things that I don't understand.

This line:

root ALL=(ALL) ALL

Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.

What would happen if I deleted this line?

And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?

I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.

And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?

  • There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL” – ctrl-alt-delor Feb 17 at 23:04
0

The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.

You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).

A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.

The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.

The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.

See also

  • Thanks for your reply. What does it mean root user? Is it user with same permissions as root? – J. Doe Feb 17 at 22:46
  • @J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html – Kusalananda Feb 17 at 22:50
  • @J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing the sudoers file. Making mistakes in that file could have serious or at least very inconvenient consequences. – Kusalananda Feb 17 at 22:55
  • If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL? – J. Doe Feb 17 at 22:57
  • @J.Doe I believe I covered those points in my answer. sudo would still deny root from using sudo if you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of the sudo program). The other difference that you ask about is a difference in how you administrate sudo privileges. I mentioned this too. You either add users individually to the sudoers file, but this may be to bothersome on large systems, so it may be easier to add users to a special sudo group. – Kusalananda Feb 17 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.