6

suppose mymachine:/etc/sudoers includes the line

joe  someremotehost = (ALL) NOPASSWD: ALL

but someremotehost:/etc/sudoers does not say anything special about joe, then what effect does the above line have?

7

In its default configuration, sudo looks in the sudoers file on the local machine (i.e., on the machine upon which it is invoked) to determine what to do - it doesn't contact another host to find out what it would permit, so in this case, the joe someremotehost line on your local machine would not affect the operation of sudo on someremotehost. And since it specifies a hostname restriction, sudo on your local machine would ignore the rule, because the hostname in the config doesn't match the hostname sudo gets from the C library.

The sudoers file syntax allows you to specify hostname restrictions so that managing policy for a large group of hosts is as easy as editing the file in one place, and then pushing it out to all hosts in the administrative domain.

  • 1
    Best to keep /etc/sudoers untouched (don't mess up root) and push-sync a central config folder to /etc/sudoers.d/ on every machine, right? – arney Apr 8 '13 at 19:52
  • That would mean that keeping the ALL instead of a specific host name makes the sudoers no less secure, if only employed locally on one box, right? – humanityANDpeace May 3 '16 at 6:27
4

When using puppet, or sharing the file with many hosts in your network, then the HOST section becomes more relevant.

3

Effectively nothing. The file on the remote host is never consulted, but the local file only gives permission on the other host, not on this host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.