Hands-on Lab·Red Hat Certified System Administrator
Privileged Access with sudo
One objective, asked constantly. Everything here is done with files in /etc/sudoers.d rather than by editing /etc/sudoers, and the guide ends by breaking a rule on purpose - which turns out not to fail the way anyone expects.
Users and Groups Guide 20 of 67 Intermediate
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 17 min
Files in /etc/sudoers.d must be mode 0440 and owned by root. sudo ignores a world-writable file, and - captured below - warns about it rather than failing, so the symptom is a rule that silently does not apply.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because it is asked constantly. This matters because a typo in a sudoers file does not fail safe - and the file permissions on a drop-in can void the rule entirely.
- seeing how sudo is granted on Red Hat
- starting from a user with no privileges at all
- granting access with a drop-in file, and granting only specific commands
- making a typo, and finding that it does not fail safe
- writing group rules, and meeting the file permissions that void them
Before you start
- A sudo-capable account.
- The session creates a user and drop-in files, and removes them all.
-
How sudo is granted on Red Hat
-
A user with no privileges
-
Granting access with a drop-in file
-
Granting only specific commands
-
A typo does not fail safe
-
Group rules, and file permissions that void them