Chapter 10. Managing sudo access

Procedure

1. As root, open the /etc/sudoers file.

   # visudo

   The /etc/sudoers file defines the policies applied by the sudo command.

2. In the /etc/sudoers file, find the lines that grant sudo access to users in the administrative wheel group.

   ## Allows people in group wheel to run all commands
   %wheel        ALL=(ALL)       ALL

3. Make sure the line that starts with %wheel is not commented out with the number sign (#).
4. Save any changes, and exit the editor.

5. Add users you want to grant sudo access to into the administrative wheel group.

    # usermod --append -G wheel <username>

   Replace <username> with the name of the user.

Procedure

1. As root, create a new sudoers.d directory under /etc/:

   # mkdir -p /etc/sudoers.d/

2. Create a new file in the /etc/sudoers.d directory:

   # visudo -f /etc/sudoers.d/<filename>

   The file opens automatically.

3. Add the following line to the /etc/sudoers.d/<filename> file:

   <username> <hostname.example.com> = (<run_as_user>:<run_as_group>) <path/to/command>

   • Replace <username> with the name of the user.
   • Replace <hostname.example.com> with the URL of the host.
   • Replace (<run_as_user>:<run_as_group>) with the user or group as which the command can be executed. If you omit this section, <username> can execute the command as root.
   • Replace <path/to/command> with the complete absolute path to the command. You can also limit the user to only performing a command with specific options and arguments by adding those options after the command path. If you do not specify any options, the user can use the command with all options.

   • To allow two and more commands on the same host on one line, you can list them separated by a comma followed by a space.

     For example, to allow user1 to execute the dnf and reboot commands on host1.example.com, enter user1 host1.example.com = /bin/dnf, /sbin/reboot.

4. Optional: To receive email notifications every time the user attempts to use sudo privileges, add the following lines to the file:

   Defaults    mail_always
   Defaults    mailto="<email@example.com>"

5. Save the changes, and exit the editor.

Verification

1. To verify if a user can run a command with sudo privileges, switch the account:

   # su <username> -

2. As the user, enter the command with the sudo command:

   $ sudo <command>
   [sudo] password for <username>:

   Enter the user’s sudo password.

3. If the privileges are configured correctly, the system displays the list of commands and options. For example, with the dnf command, it shows the following output:

   ...
   usage: dnf [options] COMMAND
   ...

   If the system returns the error message <username> is not in the sudoers file. This incident will be reported, the file for <username> in /etc/sudoers.d/ does not exist.

   If the system returns the error message <username> is not allowed to run sudo on <host.example.com>, the configuration was not completed correctly. Ensure that you are logged in as root and that the configuration was performed correctly.

   If the system returns the error message Sorry, user <username> is not allowed to execute '<path/to/command>' as root on <host.example.com>., the command is not correctly defined in the rule for the user.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: "Configure sudo"
     hosts: managed-node-01.example.com
     tasks:
       - name: "Apply custom /etc/sudoers configuration"
         ansible.builtin.include_role:
           name: rhel-system-roles.sudo
         vars:
           sudo_sudoers_files:
             - path: "/etc/sudoers"
               user_specifications:
                 - users:
                     - <user_name>
                   hosts:
                     - <host_name>
                   commands:
                     - <path_to_command_binary>

   The settings specified in the playbook include the following:

   users

   The list of users that the rule applies to.

   hosts

   The list of hosts that the rule applies to. You can use ALL for all hosts.

   commands

   The list of commands that the rule applies to. You can use ALL for all commands.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sudo/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On the managed node, verify that the playbook applied the new rules.

   # cat /etc/sudoers | tail -n1
   <user_name> <host_name>= <path_to_command_binary>