213 lines
5.4 KiB
HTML
213 lines
5.4 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of sudo_root</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>sudo_root</H1>
|
|
Section: Maintenance Commands (8)<BR>Updated: February 8, 2006<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<P>
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
sudo_root - How to run administrative commands
|
|
<P>
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<P>
|
|
<B>sudo</B>
|
|
|
|
<I>command</I>
|
|
|
|
<P>
|
|
<B>sudo -i</B>
|
|
|
|
<P>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>INTRODUCTION</H2>
|
|
|
|
<P>
|
|
By default, the password for the user "root" (the system
|
|
administrator) is locked. This means you cannot login as root or use
|
|
su. Instead, the installer will set up sudo to allow the user that is
|
|
created during install to run all administrative commands.
|
|
<P>
|
|
This means that in the terminal you can use sudo for commands that
|
|
require root privileges. All programs in the menu will use a graphical
|
|
sudo to prompt for a password. When sudo asks for a password, it needs
|
|
<B>your password, </B>
|
|
|
|
this means that a root password is not needed.
|
|
<P>
|
|
To run a command which requires root privileges in a terminal, simply
|
|
prepend
|
|
<B>sudo</B>
|
|
|
|
in front of it. To get an interactive root shell, use
|
|
<B>sudo -i</B>.
|
|
|
|
<P>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>ALLOWING OTHER USERS TO RUN SUDO</H2>
|
|
|
|
<P>
|
|
By default, only the user who installed the system is permitted to run
|
|
sudo. To add more administrators, i. e. users who can run sudo, you
|
|
have to add these users to the group 'sudo' by doing one of the
|
|
following steps:
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="1">*<DD>
|
|
In a shell, do
|
|
<P>
|
|
<DL COMPACT><DT id="2"><DD>
|
|
<B>sudo adduser</B>
|
|
|
|
<I>username</I>
|
|
|
|
<B>sudo</B>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="3">*<DD>
|
|
Use the graphical "Users & Groups" program in the "System settings"
|
|
menu to add the new user to the
|
|
<B>sudo</B>
|
|
|
|
group.
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>BENEFITS OF USING SUDO</H2>
|
|
|
|
<P>
|
|
The benefits of leaving root disabled by default include the following:
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="4">*<DD>
|
|
Users do not have to remember an extra password, which they are likely to forget.
|
|
<DT id="5">*<DD>
|
|
The installer is able to ask fewer questions.
|
|
<DT id="6">*<DD>
|
|
It avoids the "I can do anything" interactive login by default - you
|
|
will be prompted for a password before major changes can happen, which
|
|
should make you think about the consequences of what you are doing.
|
|
<DT id="7">*<DD>
|
|
Sudo adds a log entry of the command(s) run (in <B>/var/log/auth.log</B>).
|
|
<DT id="8">*<DD>
|
|
Every attacker trying to brute-force their way into your box will
|
|
know it has an account named root and will try that first. What they
|
|
do not know is what the usernames of your other users are.
|
|
<DT id="9">*<DD>
|
|
Allows easy transfer for admin rights, in a short term or long term
|
|
period, by adding and removing users from the sudo group, while not
|
|
compromising the root account.
|
|
<DT id="10">*<DD>
|
|
sudo can be set up with a much more fine-grained security policy.
|
|
<DT id="11">*<DD>
|
|
On systems with more than one administrator using sudo avoids sharing
|
|
a password amongst them.
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>DOWNSIDES OF USING SUDO</H2>
|
|
|
|
<P>
|
|
Although for desktops the benefits of using sudo are great, there are
|
|
possible issues which need to be noted:
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="12">*<DD>
|
|
Redirecting the output of commands run with sudo can be confusing at
|
|
first. For instance consider
|
|
<P>
|
|
<DL COMPACT><DT id="13"><DD>
|
|
<B>sudo ls > /root/somefile</B>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="14"><DD>
|
|
will not work since it is the shell that tries to write to that file. You can use
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="15"><DD>
|
|
<B>ls | sudo tee /root/somefile</B>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="16"><DD>
|
|
to get the behaviour you want.
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="17">*<DD>
|
|
In a lot of office environments the ONLY local user on a system is
|
|
root. All other users are imported using NSS techniques such as
|
|
nss-ldap. To setup a workstation, or fix it, in the case of a network
|
|
failure where nss-ldap is broken, root is required. This tends to
|
|
leave the system unusable. An extra local user, or an enabled root
|
|
password is needed here.
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>GOING BACK TO A TRADITIONAL ROOT ACCOUNT</H2>
|
|
|
|
<P>
|
|
<B>This is not recommended!</B>
|
|
|
|
<P>
|
|
To enable the root account (i.e. set a password) use:
|
|
<P>
|
|
<DL COMPACT><DT id="18"><DD>
|
|
<B>sudo passwd root</B>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
Afterwards, edit the sudo configuration with
|
|
<B>sudo visudo</B>
|
|
|
|
and comment out the line
|
|
<P>
|
|
<DL COMPACT><DT id="19"><DD>
|
|
%sudo ALL=(ALL) ALL
|
|
</DL>
|
|
|
|
<P>
|
|
to disable sudo access to members of the sudo group.
|
|
<P>
|
|
<A NAME="lbAI"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+sudo">sudo</A></B>(8),
|
|
|
|
<B><A HREF="https://wiki.ubuntu.com/RootSudo">https://wiki.ubuntu.com/RootSudo</A></B>
|
|
|
|
<P>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="20"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="21"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="22"><A HREF="#lbAD">INTRODUCTION</A><DD>
|
|
<DT id="23"><A HREF="#lbAE">ALLOWING OTHER USERS TO RUN SUDO</A><DD>
|
|
<DT id="24"><A HREF="#lbAF">BENEFITS OF USING SUDO</A><DD>
|
|
<DT id="25"><A HREF="#lbAG">DOWNSIDES OF USING SUDO</A><DD>
|
|
<DT id="26"><A HREF="#lbAH">GOING BACK TO A TRADITIONAL ROOT ACCOUNT</A><DD>
|
|
<DT id="27"><A HREF="#lbAI">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:16 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|