2

I am working on standardizing the sudo access in our environment. To begin with, I am understanding the current setup.

Currently, we use sudo bash to get into the root shell without typing any passwords. I understand that giving sudo access on individual commands is recommended but at least for now, I wanted a mechanism where we type our password and then get a root shell.

To re-iterate, sudo bash or sudo -s works fine but when I typed sudo su -, it prompted for my password and once I typed it, it gave me a message '*Sorry, user <username> is not allowed to execute '/bin/su -' as root on lt;server name>'. This got me curious to see how is sudo bash working.

In /etc/sudoers file, I see two lines relevant in this context:

        root    ALL=(ALL)   ALL
        %wheel  ALL=(ALL)   ALL

And I am not part of the %wheel group. admin is my default group in /etc/passwd and admin group isn't part of wheel group in /etc/group. So, to make sudo su - to work, I added below line to the sudoers file and it worked.

        %admin  ALL=(ALL)   ALL

But I am not able to understand:

  • How is sudo bash working for everyone?
  • Is everyone part of the wheel group by default?

Please let me know if I am missing something here. Also, if there are better ways to do things.

OS: CentOS 7.2 (Red Hat family)

It turns out there are certain files in /etc/sudoers.d and that's how sudo bash was working but i thought it was commented out... Thanks.

#includedir /etc/sudoers.d
Gilles 'SO- stop being evil'
  • 829,060
Ram Kumar
  • 21

1 Answers1

2

Answer assembled from comments:

The issue of why sudo bash was working for someone not in the wheel group was resolved through the realization that the main sudoers configuration file was including further configuration files from /etc/sudoers.d (and one of these files allowed this to happen).

And yes, the # at the start of #include is confusing.

A further question regarding how to safely give super-user rights to system administrators was answered by referring to the old question "Which is the safest way to get root privileges: sudo, su or login?". As is evident from the answers to that question, it is not a matter that is straight forward.

Also related: "Is there ever a good reason to run sudo su?"

Kusalananda
  • 333,661