sudo
Table of Contents
1. Switch user
From sudo(8) manual page
-i,--loginRun the shell specified by the target user’s password database entry as a login shell. This means that login-specific resource files such as.profile,.bash_profile, or.loginwill be read by the shell. If a command is specified, it is passed to the shell
Omit -u alan if the desired user is root
sudo -i -u alan
2. The /etc/sudoers.d/ directory
Use visudo(8) to create or edit sudoers(5) configuration files, the drop-in
files in /etc/sudoers.d are parsed in sorted lexical order,
e.g. /etc/sudoers.d/01_b will be parsed before /etc/sudoers.d/02_a.
sudo visudo /etc/sudoers.d/foo
2.1. Password timeout
For 30mins timeout (default is 15mins) add the following under
/etc/sudoers.d/timeout.
# /etc/sudoers.d/timeout Defaults:alan timestamp_timeout=30
2.2. Admin privileges for specific commands
Allow user foo to change users passwords except for root.
# /etc/sudoers.d/foo foo ALL = /usr/bin/passwd, !/usr/bin/passwd root
Allow members of group bar to run mount and umount commands with specific
arguments.
# /etc/sudoers.d/bar %bar ALL = /usr/bin/mount /dev/sdb, /usr/bin/umount /dev/sdb
2.3. Allow user to download a restricted path without password prompts
# /etc/sudoers.d/rsync alan ALL = NOPASSWD: /usr/bin/rsync --server --sender * . /etc/foo/
2.4. Allow user to upload files to a restricted path without password prompts
# /etc/sudoers.d/rsync alan ALL = NOPASSWD: /usr/bin/rsync --server * . /srv/bar/
3. sudoedit
The editor used by sudoedit(8) can be set with update-alternatives(1) on Debian based systems
4. Credential caching
- https://manpages.debian.org/stable/sudo-ldap/sudoers.5.en.html#User_Authentication
- https://manpages.debian.org/stable/sudo-ldap/sudoers.5.en.html#SUDOERS_OPTIONS:~:text=C%E2%80%99%2E-,timestamp%5Ftype
ppid [..]
tty One time stamp record is used for each terminal, which means that a user’s login sessions are authenticated separately. If no terminal is present, the behavior is the same as
ppid. Commands run from the same terminal will not require a password fortimestamp_timeoutminutes (15 by default).[..]
The default value is
tty.
Print current tty with the tty(1) command.
tty
5. Configure options
If the invoking user is already
root, the-Voption will display the options passed to configure when sudo was built [..]
sudo sudo -V
6. References
- https://manpages.debian.org/stable/sudo/ (remplace
stablewith codename for manpages index) - https://wiki.archlinux.org/title/Sudo
- file:///usr/share/doc/sudo/