0

is there a way if owner of an unix account (no root) can check which of non-root users are allowed to run commands as he, using sudo?

/etc/sudoers is not readable.

For my personal safety I'd like to have possibility to check who is allowed use sudo to access my account.

for example if user A can run "sudo -u myaccount -i" or any command.

1 Answer 1

0

You would have to list all the users, list that is readable for everyone at /etc/passwd; to have a clear list you could perform a:

cat /etc/passwd |cut -d : -f 1 > /tmp/userlist.txt

That would save all the users in /tmp/userlist.txt, after that you can perform a simple script to check whether the user is sudoer or not as with the command sudo -l -U username, you can check if the user has those rights. For example you can do the following script:

#!/bin/bash
cat /etc/passwd |cut -d : -f 1 > /tmp/userlist.txt

while read line
do
        sudo -l -U $line
done < /tmp/userlist.txt

rm /tmp/userlist.txt

This would print if each user is sudoer or not and also which commands can perform.

2
  • What will happen, if accounts are managed via LDAP? :)
    – rush
    Apr 26, 2019 at 11:38
  • true, users come from ldap in my case, anyhow the proposed command (sudo -l -U user) is not working for non-root users which I am
    – Chris
    Apr 26, 2019 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .