CertGrid CertGrid
Best Practices·Linux Foundation Certified System Administrator

sudo, and what it actually grants

Granting one command is a task you will be given, and the trap is that a narrow rule is often not narrow at all. This guide writes a rule into /etc/sudoers.d, validates it before installing it, checks what the user can and cannot do - and then grants exactly one more command and uses it to read /etc/shadow.

Users and Groups Guide 21 of 38 Advanced

sudo on both families. The admin group is %wheel on RHEL and %sudo on Debian and Ubuntu, and /etc/sudoers.d with an includedir is standard on both.

Both families. The RHEL transcript came first, during an outage that took both Ubuntu hosts offline; the Ubuntu half was captured afterwards and is the last step of each page, because Ubuntu is what LFCS is most likely to sit you in front of.
Server NameIP AddressOSRolesCPURAMHDD
LFCS-A01192.168.0.70Ubuntu 26.04 LTSPrimary host - most guides run only here2 Core4 GB50 GB
LFCS-C01192.168.0.72AlmaLinux 10.2The other distribution - dnf, firewalld and NetworkManager2 Core4 GB50 GB

This guide includes

Use this because granting one command is a task you will be given. This matters because a narrow rule can be a wide one - grant find and you have granted everything find can run.

Before you start

  1. What sudo already allows

  2. A rule of your own, checked before it is installed

  3. What that user can and cannot do

  4. And how a narrow rule turns out to be wide

  5. Where sudo records what happened

  6. The group is not called the same thing, and nor is the log

Official sources

← All LFCS guides