1. sudo Configuration in Linux.md

🔐 Sudo Configuration in Linux (/etc/sudoers File)

sudo (Superuser Do) allows authorized users to execute commands as root or another user while keeping system security intact. The /etc/sudoers file controls who can use sudo and what they can do.

This guide explains configuring sudo permissions properly using the visudo command.

---

📌 1. Granting Sudo Privileges to a User

✅ Method 1: Add the User to the sudo Group

On Ubuntu/Debian, users in the sudo group have admin privileges by default.

1️⃣ Add a user (nikhil) to the sudo group

sudo usermod -aG sudo nikhil

2️⃣ Verify with:

groups nikhil

3️⃣ Test sudo access:

su - nikhil
sudo whoami

✅ Output:

root

📌 For RHEL/CentOS, use the wheel group instead:

sudo usermod -aG wheel nikhil

---

📌 2. Editing the sudoers File Safely

Always use visudo to edit /etc/sudoers to avoid syntax errors.

sudo visudo

✅ Add a User with Full Root Privileges

Find the line:

root    ALL=(ALL:ALL) ALL

Below it, add:

nikhil  ALL=(ALL:ALL) ALL

🔹 This allows nikhil to run any command as root.

---

📌 3. Grant Sudo Access Without a Password (NOPASSWD)

To allow nikhil to run sudo without entering a password, modify:

nikhil  ALL=(ALL) NOPASSWD: ALL

📌 Use Case: Helpful for automation and scripts.

---

📌 4. Restrict User to Specific Commands

To allow nikhil to only restart Apache:

nikhil  ALL=(ALL) NOPASSWD: /bin/systemctl restart apache2

✅ Now nikhil can run:

sudo systemctl restart apache2

❌ But cannot run sudo rm -rf /.

---

📌 5. Grant Sudo to a User Group

Instead of adding individual users, grant sudo access to an entire group:

%developers  ALL=(ALL:ALL) ALL

✅ All users in the developers group can use sudo.

To add a user (john) to the group:

sudo usermod -aG developers john

---

📌 6. Command Aliases in sudoers File

To simplify management, define command aliases:

Cmnd_Alias WEB_CMDS = /bin/systemctl restart apache2, /bin/systemctl reload nginx
Cmnd_Alias NET_CMDS = /sbin/ifconfig, /bin/ping

Assign them:

nikhil  ALL=(ALL) NOPASSWD: WEB_CMDS, PASSWD: NET_CMDS

✅ nikhil can restart Apache/Nginx without a password
✅ But must enter a password to run networking commands

---

📌 7. Restrict Users from Running Certain Commands

To block dangerous commands (like rm -rf or fdisk):

nikhil ALL=(ALL) ALL, !/bin/rm, !/sbin/fdisk

✅ nikhil can run all commands except rm and fdisk.

---

📌 8. Log All Sudo Activity

Enable logging to track sudo usage:

Defaults logfile="/var/log/sudo.log"

✅ All sudo commands will be logged in /var/log/sudo.log.

To view logs:

cat /var/log/sudo.log

---

📌 9. Allow Root Access Without a Password for a Specific User

Defaults:nikhil !authenticate

✅ nikhil can run sudo without being asked for a password.

---

📌 10. Secure Sudo: Disable Root Login via sudo

To prevent users from running sudo su or sudo -i (full root shell):

Defaults !root_sudo

✅ Users cannot escalate to full root privileges.

---

📌 11. Removing a User from Sudo Access

To remove sudo access from a user:

sudo deluser nikhil sudo    # Ubuntu/Debian
sudo gpasswd -d nikhil wheel  # RHEL/CentOS

✅ nikhil can no longer run sudo.

---

📊 Summary of Sudoers Configuration

Configuration	Entry in /etc/sudoers	Effect
Full sudo access	nikhil ALL=(ALL) ALL	nikhil can run all commands
No password required	nikhil ALL=(ALL) NOPASSWD: ALL	nikhil can run sudo without password
Specific command only	nikhil ALL=(ALL) NOPASSWD: /bin/systemctl restart apache2	Can restart Apache but nothing else
Restrict commands	nikhil ALL=(ALL) ALL, !/bin/rm, !/sbin/fdisk	Cannot run rm or fdisk
Allow group sudo	%developers ALL=(ALL) ALL	All developers group members can use sudo
Disable root escalation	Defaults !root_sudo	Prevents sudo su
Log sudo commands	Defaults logfile="/var/log/sudo.log"	Tracks sudo usage

---