sudo is a great tool for granting specific privileges to users other that the root user. This application allows a permitted user to execute a command as the superuser or another user, as specified in the
sudoers file.
Today I'll detail the steps needed to install and configure sudo on FreeBSD from a desktop/workstation perspective, in other words I'll dwell more on less on the common user.
Let's start by install the application and then proceed to configure the
sudoers file with
visudo:
- % su
- # cd /usr/ports/security/sudo ; make install clean
- # visudo /usr/local/etc/sudoers
Uncomment the following line to allow users in the
wheel group to run all commands:
%wheel ALL=(ALL) ALL
By enabing this line, users in
wheel group will have full root privileges on the computer by providing their password in order to use administrative commands.
If you wish that users in the
wheel to acquire these privileges without using a password then uncomment the next line instead:
%wheel ALL=(ALL) NOPASSWD: ALL
sudo can also be used to allow more restrictive usage, for instance to allow the user
freebsduser to mount and unmount
/cdrom the following line could be added to
/usr/local/etc/sudoers:
freebsduser ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
To allow members of the
users group shutdown the computer add the following to the
sudoers file:
%users localhost=/sbin/shutdown -h now
Add the following line to let user freebsduser access all privileges without entering password:freebsduser ALL=(ALL) NOPASSWD: ALL
After editing the sudoers file you'll need to issue a :w! command in visudo as the file is read-only. To use sudo just prefix sudo before the command with specific privileges. For the %wheel ALL=(ALL) ALL example, if you are in the wheel group and want to shutdown the computer you'd type:
# sudo shutdown -h now
And insert your passoword.
Once you enter a correct password, sudo records
the time and for the next 5 minutes
it won't ask you for a password. After those 5 minutes you must re-authenticate. You can change the timeout value from 5 to another value by setting the password_timeout value in the /usr/local/etc/sudoers file).Every use of sudo is logged in
/var/log/messages, so do take a look and check for yourself.
I've only touched the tip of the iceberg on sudo so do take a look at its man page.