In this video, we'll explore sudo.
You've worked at sudo before.
Now let's discover some of the configuration behind it.
Easy sudo access is configured by adding users
to the wheel group.
That's for Red Hat or the sudo group if you're on Ubuntu.
If you want access to more advanced options,
you need to edit the sudo configuration file.
The name of that file is etc-sudoers,
but you cannot edit it directly.
You should use the vi-sudo command to edit it.
And vi-sudo, in the end, writes the changes
to etc-sudoers in a secure way.
Now, when you are working with sudo,
one thing is a sudo authentication token.
Sometimes people are using nopasswd in the line
that enables sudo to allow using it
without entering a password.
That is very insecure.
But why are people doing that?
Well, people are doing that because if you are using sudo,
an authentication token is generated.
So the first time you use sudo,
you are prompted for a password.
Based on that password, a token is generated.
And that token enables the same user
to run additional sudo commands
without having to enter a password every time.
Now, the problem is that by default,
this token expires after a few minutes.
And then the user needs to enter the password again.
And if you are working with sudo all day long,
that is annoying.
So probably you want to avoid that.
And in order to avoid it,
you can add the default timestamp type is global
and timestamp timeout is 60.
So default timestamp type is global.
That applies to users no matter
how they are logging into your system.
And timestamp timeout is 60,
is setting the expiry of the authentication token
to 60 minutes.
Now, the 60, of course, is whatever you want.
You think that 60 minutes is not enough,
set it to longer or set it to shorter,
but it is better than using no-pass-wd.
And that is because the situation will be
that you enter your password at the beginning of a session.
And then you can work all morning long
without having to enter your sudo password again.
I mean, you've been logged in anyway.
Then you go for lunch, you log out.
And after coming back from lunch,
you enter your password again.
You only have to enter it twice a day
instead of all the time.
And that is way more secure
than setting the no-pass-wd option.
In sudo, you can also work with drop-in files.
So instead of writing directly to etc-sudoers,
drop-in files can be added to etc-sudoers.d.
Now, this is a generic approach
of working with configuration files in Linux.
In the old days, you would just have one configuration file.
Nowadays, as Linux systems are often managed,
you want to distinguish between the managed content
in the default configuration file and your own content,
which is often created in a drop-in file.
And the strategy is to use a drop-in file with the name
etc-name-of-the-configuration-file.d.
And then you create your own configuration.
Now, in the sudo drop-in files,
you can add configuration for individual users and or groups.
Like linda-all is user-bin-pass-wd,
not user-bin-pass-wd-root,
which would allow you, linda, to set passwords,
but not for user-root.
Or if you really want it, lisa-all is all-no-pass-wd-all.
Let me show you a bit before continuing.
So first, I'm going to use vi-sudo.
And in vi-sudo, what am I going to do?
Well, I'm going to add this default parameter
to manage the lifetime of the authentication token.
Now, a default parameter can occur more than once
in a sudoer file, and that's what I do,
and I like to have it close to the other default parameters
so that I can easily find my defaults.
So default timestamp type is global.
This parameter makes that it applies
no matter how a user is logging in.
So also for SSH sessions, for instance.
And timestamp timeout is 240.
What you are going to select here
really depends on what you want to do.
I like 240 because that requires me
to enter a password twice only.
And you want to do it differently,
change it to whatever you want.
I'm applying my changes,
and then I'm getting into etc-sudoers.d,
and there I'm creating my file linda.conf.
And in linda.conf, I'm adding the line
that I want to use linda-all-is-user-bin-pass-wd,
and not user-bin-pass-wd-root.
Now we want to test that, right?
So let me do a user-add linda.
This is a CentOS system, so if I use user-add linda,
I get a bash shell by default,
and I get a home directory by default,
and that is the way I want it.
And user-add lisa to create user lisa as well.
Good.
Now I'm going to use su linda
to open a shell as user linda.
I'm a little bit lazy.
I never set a password for user linda,
but as I'm doing this as user root,
I don't have to enter a password.
So now I'm user linda,
and I should be able to use sudo passwd lisa.
Is that going to work?
Uh-uh.
Password for linda.
So my laziness is not rewarded here.
I do need a password for user linda anyway.
That's because of the default password check
when users are using sudo.
Remember, the user who's using sudo
needs to enter their own passwords.
So now that I'm in my sudoers.d,
I can create a file for the user,
and let's create the file linda,
in which I'm putting linda.
All is user bin passwd,
and not user bin passwd root.
That should be doing it.
So next, it's time to test, right?
So let's use get-end passwd linda
to check if we have a user linda,
and there we can see we have a user linda.
Get-end is a nice command
because it's printing all the properties of the user
as it was found in the authentication database.
In this case, it's simply etc passwd.
Also make sure that this user has a password,
and then you can open a shell as the user,
and that's what I'm doing right now, su minus linda.
As I'm doing that as root,
I don't have to enter a password at all,
but now I should be able to use sudo passwd lisa.
Entering the password for linda,
and there we can see I'm prompted for the new password,
going once and going twice.
And what happens if we try to do that for user root?
Well, then we get the error message,
user linda is not allowed,
and that's because we excluded this functionality.
Right, let's get back to the slides
because I need to tell you about sudo edit.
Sudo edit is a nice command, and why is that?
Well, that is because from a regular editor,
often there is an option to open a shell.
So from vim, you can use colon shell to open a shell.
And what does that mean?
That means that if you do that from sudo vim session,
the shell is a shell to the sudo vim session,
and for that reason, you can open a root shell.
That's not really something that you normally want.
And that is why, if you want to prevent users
from having unlimited shell access in this way,
you better use sudo edit instead of giving a user
sudo privileges to use vim.
In order to activate sudo edit,
you need to include it in the sudo configuration.
And this is how it works.
So linda all is sudo edit comma not sudo edit sudoers.
And as a result, the user can just run sudo edit
without sudo in front of it.
Let's check it out.
So I'm getting back to the linda configuration file
where I'm going to add the sudo edit command.
So sudo edit and not sudo edit etc sudoers.
And now I can open my shell as usual linda again.
And there I'm using sudo edit etc hosts.
And here is etc hosts.
And can linda put something in there?
192.168.29.111.dummy.example.com, for instance.
And as you can see, that works.
And ls minus l on etc hosts is showing
that really you need escalated privileges in order to do so.
Also notice that sudo edit is using the sudo authentication
token.
There was no need for user linda to enter the password again.