linuxexpert-practice-labs/labs/linux-terminal/3-4-sudo-policies

Using Linux Terminal 3.4: sudo policies

A narrow passwordless rule in a drop-in file, an administrator by group membership, and the file names sudo skips.

Before you start

Work as root (sudo -i), and write answers to the files in /root/lab-answers/. The lab creates users alice and bob (password Lab-Pass-1). Edit sudoers files only with visudo (visudo -f /etc/sudoers.d/NAME): it refuses to save a file with a mistake in it, and a broken sudoers file stops sudo working for everyone. Keep the root shell open while you work. The lab saves /etc/sudoers and puts it back on reset, and removes the files you add to /etc/sudoers.d.

Tasks

1. Let alice restart and check the status of the ssh service as root, with no password, and nothing else. Use a drop-in file. visudo -c reports every file "parsed OK"; as alice, sudo systemctl restart ssh works, and sudo id asks for her password and then says she isn't allowed.
2. Make bob an administrator who can run anything with his password, without editing any sudoers file.
3. Name your drop-in alice.conf instead, and see what sudo -l -U alice says. Write that to /root/lab-answers/3, then rename the file back.

Hints

• alice ALL=(root) NOPASSWD: /usr/bin/systemctl restart ssh, /usr/bin/systemctl status ssh; sudo -l -U alice; test as alice with su - alice.
• Ubuntu's /etc/sudoers gives group sudo everything; usermod -aG.
• @includedir /etc/sudoers.d skips names with a dot or ending in ~.