We have a user support group and want to allow them to login to non-root users via sudo.

%user-support  ALL = (ALL) /bin/bash, !/bin/bash *root*

We put the above code in /etc/sudoers.d, and the user support group can log in to other users. However, they can also log in to root using the sudo -u root -i command.

Is there a way to block the user support group from becoming root?

Allow the user-support login to other users except for root.


1 Answer 1


= (ALL) is the part that specifies the list of users, as which the configured commands can be run as.

For example:

# who            # where     # whoas          #what
user1            ALL       = (user2)        : /bin/ls
%group1          alpha     = (%group2)      : /bin/cp

user1 can run sudo -u user2 ls on all hosts, that have this configuration

All users in the group group1 can run cp via sudo only on host alpha as user in group2

Instead of using unix-/ldap-groups, User_Alias could be used as well to define "groups".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .