214 Technique 32: sudo Pseudonyms

Installing sudo

To find out if sudo is installed on your computer, look for a file called /etc/sudoers. If it’s not there, install sudo from your Linux distribution disc. Open a terminal window and give yourself superuser privileges with the su command. Mount the distribution disk, move into the directory holding the RPM packages, and install sudo with the following command:

# rpm -Uhv sudo-version.rpm

Adding Up the Aliases

The sudoers file holds sudo configuration information; program permissions and sudo aliases are defined in /etc/sudoers. An alias (a sudo alias anyway) is a name that you give to a group of one or more users, hosts, commands, or “run as” names.

The idea behind an alias is that you can assign (or deny) privileges to the named group rather than to each individual group member, making setup and maintenance much easier. For example, you may have a small group of users who perform system maintenance tasks (such as backup and restore operations). Rather than assigning privileges to each individual operator, create an operator alias (a group that includes all your operators) and assign backup and restore privileges to the alias. That way, if you hire new operators, you simply add them to the operator alias, and they have all the privileges they need. Or, if you switch to a different backup program, you can change the privileges assigned to the operator group rather than to each individual.

By modifying the sudoers file, you can create four kinds of aliases:

User_Alias: A User_Alias creates a group of users. A User_Alias definition can contain a combination of groups, individual users, and other user aliases.

Runas_Alias: Using a Runas_Alias allows a user to borrow the privileges of another user (typically, root). A Runas_Alias definition can include user names, UIDs, user groups, and other

Runas_Aliases.

Host_Alias: Use a Host_Alias to manage groups of computers if you manage a large network. Assigning a Host_Alias to a group of Web servers allows you to apply sudo rules to all the systems in the group. A Host_Alias can reference host names, IP addresses, netmasks, or other host aliases.

Cmnd_Alias: A command alias groups similar commands (similar in their danger levels). Grouping commands like rm, mkfs, and parted (potentially dangerous commands) and limiting access to them can help decrease the likelihood that you’ll be restoring from backup anytime soon. A Cmnd_Alias can refer to command names, directories, and other command aliases.

Adding Aliases to the sudo Configuration File

sudo aliases are defined in the /etc/sudoers file. Adding an alias is quick and simple:

1. Open the terminal window and give yourself superuser privileges with the su - command.

2. Tell the visudo command (which you use in a moment) which editor you want to use (the default editor is vi, and we’d rather not go there).

For example, if you want to use kedit, use the following command:

# export EDITOR=kedit

You can use kate, emacs, or another editor if you prefer.

3. To edit the /etc/sudoers file, enter the following command:

# visudo