I want my user xxxx to NOT have root access, except when using sudo.
This is actually the normal state for regular users: you don't have to do anything, other than configure
sudo to specify which commands to allow.
root ALL=(ALL:ALL) ALL
This line exists just to allow the use of
sudo if you are already switched to the root user. The important line that grants permissions to non-root users is this one:
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
(In some Linux distributions, the first regular user generated during the OS installation may become a member of the
sudo group and thus have root access enabled for them automatically. This is the exception, not a default for all users.)
The basic form of the permission specification in the sudoers file is
<who> <where>=(<as_who>) <what>
<who> specifies which user(s) get to use this entry. It can be a user, a group (prefixed with a % sign), or a previously-defined User_Alias (basically a shorthand for a long list of users and/or groups) and a few other things.
<where> can be a hostname: it restricts this entry to a particular system. It might be useful in an enterprise environment where you slap a centrally-managed standard
sudoers file on all hosts, but often this is specified as ALL to avoid problems in case hostname resolution is not working or the system is misconfigured.
(<as_who>) defines the user account(s) the commands can be run as. The default is root, but you could also restrict an user to be able to run commands with sudo on some specific non-root application account only, for example.
<what> is the command (or commands, separated with commas) to allow.
There are also various tags and options, but the above is the important part of the
sudoers file in a nutshell.
When using sudo I want the xxxx user to be prompt for the root password and not his own password
This is possible, and quite easy to do. If you add these lines to your
xxxx ALL=(ALL:ALL) ALL
then for user
xxxx (and only for them), the
sudo command will ask for a root password - and it will ask every time the
sudo command is used, instead of the default behavior of allowing up to 15 minutes of time for using the
sudo command without asking for the password again.
This is important if you plan to be monitoring the user and typing the root password yourself when needed by this user - if you miss the
timestamp_timeout=0 option, the user may first ask you to enter the root password for some legitimate action, then make up some distraction for you within the next 15 minutes, and during that time they will be able to use
sudo for anything they want.
But note that if you tell your user the root password, they will be able to use it with the
su command also, unless you apply non-default restrictions to
su. The classic (and usually the only) way to restrict
su is to require the user to be a member of a particular group, or else they won't be able to use
su at all. To apply this restriction, edit
/etc/pam.d/su and find this part near the beginning:
# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth required pam_wheel.so
Just remove the
# from the beginning of the last line and the
su command will be usable by the members of the
root group only.