0

I have appuser user in RHEL OS. This user is not in the wheel group. 

[appuser@NTTAXB01 ~]$ grep wheel /etc/group
wheel:x:10:secadmin,igwuser
[appuser@NTTAXB01 ~]$ getent group wheel
wheel:x:10:secadmin,igwuser

But sudo access is possible with this user.

[appuser@NTTAXB01 ~]$ sudo su
[sudo] password for appuser: 
[root@NTTAXB01 appuser]#

How is this possible? Am I missing anything?

Improve this question
4
  • 1
    please provide id appuser and grep -v "#" /etc/sudoers output.
    – binarysta
    Commented Apr 24, 2020 at 11:15
  • $ id appuser uid=1000(appuser) gid=1001(appuser) groups=1001(appuser)
    – Pradeep Sanjeewa
    Commented Apr 24, 2020 at 11:20
  • so please check /etc/sudoers, it may be defined individually for this user.
    – binarysta
    Commented Apr 24, 2020 at 11:23
  • Due to word limit restriction, only mentioning the following output from grep -v "#" /etc/sudoers. root ALL=(ALL) ALL appuser ALL=(ALL) ALL secadmin ALL=(ALL) ALL %wheel ALL=(ALL) ALL
    – Pradeep Sanjeewa
    Commented Apr 24, 2020 at 11:24

2 Answers 2

Reset to default
1

As mentioned in comments:

$id appuser

uid=1000(appuser) gid=1001(appuser) groups=1001(appuser)

And from output of grep -v "#" /etc/sudoers

this line shows that this user have been added individually.

appuser ALL=(ALL) ALL

You can have a look for the configuration of sudo at sudeoers file

Improve this answer
7
  • Does that mean we can add users to sudoers list without adding its group to sudoers list, is that?
    – Pradeep Sanjeewa
    Commented Apr 24, 2020 at 11:32
  • 1
    yes exactly. you can add either the user or its group.
    – binarysta
    Commented Apr 24, 2020 at 11:34
  • Thanks, very helpful
    – Pradeep Sanjeewa
    Commented Apr 24, 2020 at 11:34
  • BTW, anything we can grab from id appuser here for this problem?
    – Pradeep Sanjeewa
    Commented Apr 24, 2020 at 11:38
  • 1
    no it's wrong. @PradeepSanjeewa id appuser can show for example sysadmin group in the group list of the user. and then in sudoers file we can see %sysadmin ALL=(ALL) ALL and not appuser ALL=(ALL) ALL then again this user will have sudo privilege because the user is in sysadmin group which has sudo privilege. Please have a look at the guide link I put in the answer.
    – binarysta
    Commented Apr 24, 2020 at 12:20
0

Users of sudo, and the rights they have, can be individually defined in /etc/sudoers and/or in additional files in the /etc/sudoers.d directory.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .