0

I created a new user with adduser but when I tried to sudo from his account I got xxxx * is not in the sudoers file. This incident will be reported..

So I started tampering with the visudo command...

I get that root account has the following config:

root    ALL=(ALL:ALL) ALL

But I don't want to duplicate this for my new user...


I want my user xxxx to NOT have root access, except when using sudo.
When using sudo I want the xxxx user to be prompt for the root password and not his own password !!

Thx


Using debian 10
VM, ssh only

2
  • You could use su instead of sudo. Or you can change the behaviour of sudo for everyone
    – roaima
    Mar 16 '20 at 23:08
  • 1
    Then have the user use su - instead of sudo and don't put him in the sudoers file. Mar 17 '20 at 0:24
5

I want my user xxxx to NOT have root access, except when using sudo.

This is actually the normal state for regular users: you don't have to do anything, other than configure sudo to specify which commands to allow.

root    ALL=(ALL:ALL) ALL

This line exists just to allow the use of sudo if you are already switched to the root user. The important line that grants permissions to non-root users is this one:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

(In some Linux distributions, the first regular user generated during the OS installation may become a member of the sudo group and thus have root access enabled for them automatically. This is the exception, not a default for all users.)

The basic form of the permission specification in the sudoers file is

<who>  <where>=(<as_who>) <what>
  • <who> specifies which user(s) get to use this entry. It can be a user, a group (prefixed with a % sign), or a previously-defined User_Alias (basically a shorthand for a long list of users and/or groups) and a few other things.

  • <where> can be a hostname: it restricts this entry to a particular system. It might be useful in an enterprise environment where you slap a centrally-managed standard sudoers file on all hosts, but often this is specified as ALL to avoid problems in case hostname resolution is not working or the system is misconfigured.

  • (<as_who>) defines the user account(s) the commands can be run as. The default is root, but you could also restrict an user to be able to run commands with sudo on some specific non-root application account only, for example.

  • <what> is the command (or commands, separated with commas) to allow.

There are also various tags and options, but the above is the important part of the sudoers file in a nutshell.

When using sudo I want the xxxx user to be prompt for the root password and not his own password

This is possible, and quite easy to do. If you add these lines to your sudoers file:

Defaults:xxxx rootpw,timestamp_timeout=0
xxxx    ALL=(ALL:ALL) ALL

then for user xxxx (and only for them), the sudo command will ask for a root password - and it will ask every time the sudo command is used, instead of the default behavior of allowing up to 15 minutes of time for using the sudo command without asking for the password again.

This is important if you plan to be monitoring the user and typing the root password yourself when needed by this user - if you miss the timestamp_timeout=0 option, the user may first ask you to enter the root password for some legitimate action, then make up some distraction for you within the next 15 minutes, and during that time they will be able to use sudo for anything they want.

But note that if you tell your user the root password, they will be able to use it with the su command also, unless you apply non-default restrictions to su. The classic (and usually the only) way to restrict su is to require the user to be a member of a particular group, or else they won't be able to use su at all. To apply this restriction, edit /etc/pam.d/su and find this part near the beginning:

# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth       required   pam_wheel.so

Just remove the # from the beginning of the last line and the su command will be usable by the members of the root group only.

1
  • Great answer. Thx
    – Doctor
    Mar 18 '20 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.