SUDO - granting privileges to Linux users

Sudo is a command (utility) in Linux environments that allows selected users to execute commands (programs) with the privileges of other users, e.g., with "root" privileges. For a selected user to be able to execute commands that fall outside their standard permissions, an appropriate entry must be added to the configuration file that controls the sudo command. The configuration file is typically:

/etc/sudoers 

Project homepage: http://www.sudo.ws/

The command syntax for the user is quite simple: 

After issuing the command (unless the no-password option is set), the user will be prompted for a password, which is the user's own password.

sudo -v 

We can also force the system to forget the password immediately using the command: 

sudo -k 

The simplest basic configuration can be performed by issuing the following command from the "root" account: 

where "loginname" is the name of the regular user. 

If there is no need to require a password from the user when executing sudo commands, we can disable the password prompt by adding the following entry: 

Although the /etc/sudoers file can be edited directly using, for example, vi or nano, it is better to use a tool specifically designed for this purpose called: visudo. This command is superior because, upon exiting the editor and saving changes, it performs a syntax check, and if any errors are found, an appropriate message will be displayed. 

Typically, sudo permission entries in the /etc/sudoers file take the form: 

where "loginname" represents the username, "system" is the host from which the command can be executed (i.e., the system the user must be logged into when issuing the sudo command), and "command1..." are the commands the user will be able to execute beyond their own privilege level. 

We can also grant permissions to an entire group of users in the following format: 

where "groupname" is the name of the system group, and the other parameters are as defined above. Remember to prefix the group name with a "%" sign. 

For example, an entry allowing user "user1", logged in locally, to execute the "fdisk" command without a password prompt looks like this: 

%users localhost=NOPASSWD:/sbin/shutdown -h now

To check which sudo permissions you have, issue the command:

sudo -l 

Documentation (manual) for version 1.8.6 - http://www.sudo.ws/sudo/man/1.8.6/sudo.man.html