Show Table of Contents
126.96.36.199. The sudo Command
sudocommand offers another approach to giving users administrative access. When trusted users precede an administrative command with
sudo, they are prompted for their own password. Then, once authenticated and assuming that the command is permitted, the administrative command is executed as if by the root user.
The basic format of the
sudocommand is as follows:
In the above example, <command> would be replaced by a command normally reserved for the root user, such as
Users of the
sudocommand should take extra care to log out before walking away from their machines since sudoers can use the command again without being asked for a password within a five minute period. This setting can be altered via the configuration file,
sudocommand allows for a high degree of flexibility. For instance, only users listed in the
/etc/sudoersconfiguration file are allowed to use the
sudocommand and the command is executed in the user's shell, not a root shell. This means the root shell can be completely disabled, as shown in Section 4.4.1, “Allowing Root Access”.
sudocommand also provides a comprehensive audit trail. Each successful authentication is logged to the file
/var/log/messagesand the command issued along with the issuer's user name is logged to the file
Another advantage of the
sudocommand is that an administrator can allow different users access to specific commands based on their needs.
Administrators wanting to edit the
/etc/sudoers, should use the
To give someone full administrative privileges, type
visudoand add a line similar to the following in the user privilege specification section:
juan ALL=(ALL) ALL
This example states that the user,
juan, can use
sudofrom any host and execute any command.
The example below illustrates the granularity possible when configuring
%users localhost=/sbin/shutdown -h now
This example states that any user can issue the command
/sbin/shutdown -h nowas long as it is issued from the console.
The man page for
sudoershas a detailed listing of options for this file.