Today I'll detail the steps needed to install and configure sudo on FreeBSD from a desktop/workstation perspective, in other words I'll dwell more on less on the common user.
Let's start by install the application and then proceed to configure the sudoers file with visudo:
- % su
- # cd /usr/ports/security/sudo ; make install clean
- # visudo /usr/local/etc/sudoers
%wheel ALL=(ALL) ALLBy enabing this line, users in wheel group will have full root privileges on the computer by providing their password in order to use administrative commands.
If you wish that users in the wheel to acquire these privileges without using a password then uncomment the next line instead:
%wheel ALL=(ALL) NOPASSWD: ALLsudo can also be used to allow more restrictive usage, for instance to allow the user freebsduser to mount and unmount /cdrom the following line could be added to /usr/local/etc/sudoers:
freebsduser ALL=/sbin/mount /cdrom,/sbin/umount /cdromTo allow members of the users group shutdown the computer add the following to the sudoers file:
%users localhost=/sbin/shutdown -h nowAdd the following line to let user freebsduser access all privileges without entering password:
freebsduser ALL=(ALL) NOPASSWD: ALLAfter editing the sudoers file you'll need to issue a :w! command in visudo as the file is read-only. To use sudo just prefix sudo before the command with specific privileges. For the %wheel ALL=(ALL) ALL example, if you are in the wheel group and want to shutdown the computer you'd type:
# sudo shutdown -h nowAnd insert your passoword.
Once you enter a correct password, sudo records the time and for the next 5 minutes
it won't ask you for a password. After those 5 minutes you must re-authenticate. You can change the timeout value from 5 to another value by setting the password_timeout value in the /usr/local/etc/sudoers file).
Every use of sudo is logged in /var/log/messages, so do take a look and check for yourself.
I've only touched the tip of the iceberg on sudo so do take a look at its man page.