Tip: Enable sudo completion in tcsh/csh shell

Having installed and setup sudo I realized that the C shell (e.g. tcsh/csh) didn't autocomplete commands issued after typing sudo.

Place the following in your .cshrc file:

set complete = enhance
complete sudo 'n/-l/u/' 'p/1/c/'

And finally source the changes:

% source .cshrc

For more information visit tcsh(1) in the REFERENCE section under complete.

Tip: Solving the sudo redirect "problem"

Upon using sudo more frequently I came across an issue while using redirects, for example:

% sudo echo WITHOUT_IPFILTER=yes > /etc/make.conf
root: Permission denied.

The key to solve the "problem" was to run the command in a sub-shell to make the redirection work, like so:

% sudo sh -c 'echo WITHOUT_IPFILTER=yes > /etc/make.conf'

The answer to this lies in man sudo ;)

HowTo: Using sudo on FreeBSD

sudo is a great tool for granting specific privileges to users other that the root user. This application allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file.

Today I'll detail the steps needed to install and configure sudo on FreeBSD from a desktop/workstation perspective, in other words I'll dwell more on less on the common user.

Let's start by install the application and then proceed to configure the sudoers file with visudo:

1. % su
2. # cd /usr/ports/security/sudo ; make install clean
3. # visudo /usr/local/etc/sudoers

Uncomment the following line to allow users in the wheel group to run all commands:

%wheel ALL=(ALL) ALL

By enabing this line, users in wheel group will have full root privileges on the computer by providing their password in order to use administrative commands.

If you wish that users in the wheel to acquire these privileges without using a password then uncomment the next line instead:

%wheel ALL=(ALL) NOPASSWD: ALL

sudo can also be used to allow more restrictive usage, for instance to allow the user freebsduser to mount and unmount /cdrom the following line could be added to /usr/local/etc/sudoers:

freebsduser ALL=/sbin/mount /cdrom,/sbin/umount /cdrom

To allow members of the users group shutdown the computer add the following to the sudoers file:

%users localhost=/sbin/shutdown -h now

Add the following line to let user freebsduser access all privileges without entering password:

freebsduser ALL=(ALL) NOPASSWD: ALL

After editing the sudoers file you'll need to issue a :w! command in visudo as the file is read-only. To use sudo just prefix sudo before the command with specific privileges. For the %wheel ALL=(ALL) ALL example, if you are in the wheel group and want to shutdown the computer you'd type:

# sudo shutdown -h now

And insert your passoword.

Once you enter a correct password, sudo records the time and for the next 5 minutes it won't ask you for a password. After those 5 minutes you must re-authenticate. You can change the timeout value from 5 to another value by setting the password_timeout value in the /usr/local/etc/sudoers file).

Every use of sudo is logged in /var/log/messages, so do take a look and check for yourself.

I've only touched the tip of the iceberg on sudo so do take a look at its man page.