Initial Settings : Sudo Settings2024/10/31

	Configure Sudo to separate users' duty if some people share privileges. It does not need to install sudo manually because it is installed by default even if Minimal installed environment.
[1]	Transfer root privilege all to a user.

[root@dlp ~]#

visudo

# add to last line : user [fedora] can use all root privilege

fedora  ALL=(ALL)       ALL

# how to write ⇒ destination host=(owner) command

# verify with user [fedora]

[fedora@dlp ~]$

/usr/bin/cat /etc/shadow

/usr/bin/cat: /etc/shadow: Permission denied

# denied normally

[fedora@dlp ~]$

sudo /usr/bin/cat /etc/shadow

[sudo] password for fedora:     # user password

.....
.....
systemd-coredump:!*:20027::::::
systemd-resolve:!*:20027::::::
systemd-timesync:!*:20027::::::   # executed

[2]	In addition to the setting of [1], set some commands prohibit.

[root@dlp ~]#

visudo

# line 49 : add
# for example, set alias for the kind of shutdown commands

Cmnd_Alias SHUTDOWN = /usr/sbin/halt, /usr/sbin/shutdown, \
/usr/sbin/poweroff, /usr/sbin/reboot, /usr/sbin/init, /usr/bin/systemctl

# add ( prohibit commands in alias [SHUTDOWN] )

fedora  ALL=(ALL)       ALL, !SHUTDOWN

# verify with user [fedora]

[fedora@dlp ~]$

sudo /usr/sbin/reboot

[sudo] password for fedora:
Sorry, user fedora is not allowed to execute '/usr/sbin/reboot' as root on dlp.srv.world.

# denied normally

[3]	Transfer some commands with root privilege to users in a group.

[root@dlp ~]#

visudo

# line 51 : add
# for example, set alias for the kind of user management commands

Cmnd_Alias USERMGR = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod, \
/usr/bin/passwd

# add to last line

%usermgr ALL=(ALL) USERMGR

[root@dlp ~]#

groupadd usermgr

[root@dlp ~]#

usermod -aG usermgr redhat

# verify with user [redhat]

[redhat@dlp ~]$

sudo /usr/sbin/useradd testuser

[redhat@dlp ~]$

sudo /usr/bin/passwd testuser

New password:
Retype new password:
passwd: password updated successfully

# executed

[4]	Transfer a command with root privilege to a user.

[root@dlp ~]#

visudo

# add to last line : settings for each user

fedora  ALL=(ALL)       /usr/sbin/visudo
ubuntu  ALL=(ALL)       /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod, /usr/bin/passwd
debian  ALL=(ALL)       /usr/bin/vi

# for example, verify with user [fedora]

[fedora@dlp ~]$

sudo /usr/sbin/visudo

## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##

# executed

[5]	It's possible to display Sudo logs on Journald ( with [journalctl] command ) or Rsyslogd ( in [/var/log/secure] file ), but if you'd like to keep only Sudo logs in another file, Configure like follows.

[root@dlp ~]#

visudo

# add to last line
# for example, output logs to [local1] facility

Defaults syslog=local1

[root@dlp ~]#

vi /etc/rsyslog.conf

# line 48,49 : add like follows

*.info;mail.none;authpriv.none;cron.none;local1.none   /var/log/messages
local1.*                /var/log/sudo.log

# The authpriv file has restricted access.
authpriv.*              /var/log/secure

[root@dlp ~]#

touch /var/log/sudo.log

[root@dlp ~]#

chmod 600 /var/log/sudo.log

[root@dlp ~]#

systemctl restart rsyslog

Matched Content