The sudo Logic: Delegating Power

In the early days of Linux, you were either a "Peasant" (Normal User) or a "God" (Root). There was no in-between. To do anything administrative, you had to log in as root.

sudo (Substitute User Do) changed this.

sudo allows a normal user to perform actions with the permissions of another user (usually root), but it records every action in a log and can limit exactly which commands the user can run. In this lesson, we will learn to manage the "Rulebook" of administrative power: the /etc/sudoers file.

---

2. The Golden Tool: visudo

CRITICAL WARNING: Never edit /etc/sudoers with a normal text editor like nano or vi. If you make a mistake and save the file, you might lock yourself out of administrative power forever.

Always use sudo visudo. This tool opens the file, but before it saves, it checks your syntax. If you made a mistake, it will say "What now?" and prevent you from saving the broken file.

---

3. Decoding a sudoers Rule

A standard rule follows this pattern: user_or_group host=(run_as_user:run_as_group) commands

I. The "Full Power" Rule:

sudeep ALL=(ALL:ALL) ALL

• sudeep: The user.
• ALL: On any machine (host).
• (ALL:ALL): As any user or group.
• ALL: Any command.

II. The "Specific Power" Rule:

developer ALL=(root) /usr/bin/apt, /usr/sbin/service

• This user can ONLY run apt and service. They cannot delete files or read sensitive passwords.

---

4. The 'NOPASSWD' Flag: Automation vs. Security

By default, sudo asks for your password. This is great for humans, but bad for automation scripts (like a backup script).

# Allow the 'backups' user to run rsync as root without a password
backups ALL=(root) NOPASSWD: /usr/bin/rsync

Warning: Use this sparingly. If a hacker breaks into the backups user, they now have a passwordless door to root!

---

5. Groups and the % Syntax

Most distros handle sudo via a group (usually called sudo or wheel).

# Anything starting with % is a GROUP
%sudo ALL=(ALL:ALL) ALL

If you want to give someone admin power, don't edit the sudoers file. Just add them to the group: sudo usermod -aG sudo new_user.

---

6. Practical: The Sudo Session Timeout

By default, once you type your password, sudo remembers you for 15 minutes. You can change this for tighter security.

# In /etc/sudoers (via visudo)
Defaults timestamp_timeout=5

Setting it to 0 means every single sudo command requires a password. Setting it to -1 means the session never expires until you log out.

---

7. Example: A Sudo Access Auditor (Python)

If you are managing a server, you should know exactly who has the potential to become root. Here is a Python script that parses the /etc/group and /etc/sudoers to find all "Potential Gods."

import subprocess
import os

def list_admin_users():
    """
    Finds users in the sudo/wheel groups and those explicitly in sudoers.
    """
    print("--- Administrative Access Audit ---")
    print("-" * 35)
    
    # 1. Check groups
    try:
        res = subprocess.run(["grep", "-E", "^(sudo|wheel):", "/etc/group"], 
                             capture_output=True, text=True)
        print(f"Group-based Admins: {res.stdout.strip()}")
    except Exception:
        pass
        
    # 2. Check the raw sudoers file (Safely)
    if os.path.exists("/etc/sudoers"):
        print("\nDirect sudoers Entries:")
        # We use 'sudo cat' to read it since it's restricted
        res = subprocess.run(["sudo", "cat", "/etc/sudoers"], capture_output=True, text=True)
        for line in res.stdout.split('\n'):
            if line and not line.startswith('#') and not line.startswith('Defaults'):
                print(f"  {line}")

if __name__ == "__main__":
    list_admin_users()

---

8. Professional Tip: Use 'sudo -i' over 'su'

Never use the su (Switch User) command to become root. Why? Because su doesn't log what you do. If you use sudo -i, everything you do is tied to your specific username in the logs. This is essential for "Chain of Custody" in professional environments.

---

9. Summary

sudo is the gatekeeper of administrative integrity.

• visudo is the only safe way to edit rules.
• Principle of Least Privilege: Only give users the specific commands they need.
• Groups (sudo/wheel) are the easiest way to manage general admins.
• Logs are created for every sudo attempt (check /var/log/auth.log).
• NOPASSWD is for automation, but it is a security risk.

In the next lesson, we will go deeper into the heart of the login process: PAM (Pluggable Authentication Modules).

Quiz Questions

1. Why is it dangerous to edit /etc/sudoers with a standard editor like nano?
2. What does the ALL=(ALL:ALL) ALL line actually mean in plain English?
3. How can you find out what commands a user is specifically allowed to run via sudo? (Hint: sudo -l)

---

Continue to Lesson 3: PAM—The Gatekeeper of Authentication.