0

is there a way if owner of an unix account (no root) can check which of non-root users are allowed to run commands as he, using sudo?

/etc/sudoers is not readable.

For my personal safety I'd like to have possibility to check who is allowed use sudo to access my account.

for example if user A can run "sudo -u myaccount -i" or any command.

0

You would have to list all the users, list that is readable for everyone at /etc/passwd; to have a clear list you could perform a:

cat /etc/passwd |cut -d : -f 1 > /tmp/userlist.txt

That would save all the users in /tmp/userlist.txt, after that you can perform a simple script to check whether the user is sudoer or not as with the command sudo -l -U username, you can check if the user has those rights. For example you can do the following script:

#!/bin/bash
cat /etc/passwd |cut -d : -f 1 > /tmp/userlist.txt

while read line
do
        sudo -l -U $line
done < /tmp/userlist.txt

rm /tmp/userlist.txt

This would print if each user is sudoer or not and also which commands can perform.

  • What will happen, if accounts are managed via LDAP? :) – rush Apr 26 at 11:38
  • true, users come from ldap in my case, anyhow the proposed command (sudo -l -U user) is not working for non-root users which I am – Chris Apr 26 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.