s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

sudo

Run a command as root (or another user) with your own password, if the sudo rules allow it.

Level
RHCSA exam
Group
Users and groups
Needs root
For changes
Package
sudo
Also called
sudoedit

What it does

sudo checks the rules in /etc/sudoers and /etc/sudoers.d/. When a rule allows you, it asks for your password (not root's) and runs the command. After that it remembers you for some minutes (on RHEL 5 minutes per terminal).

Every use is logged with your real name (in /var/log/secure and the journal). This makes sudo safer than a shared root password, and with small rules you can give people only the commands they need (least privilege).

On RHEL, members of the group wheel may run every command. sudoedit (= sudo -e) edits a file safely with your own editor.

How to write it

sudo [OPTION]... COMMAND [ARGUMENT]...
sudo -i | -s [COMMAND]
sudo -l [-U USER] [COMMAND]
sudo -e FILE...
sudo -v | -k | -K

Options 31

Most used

Run commands

-u, --user=USER
Run as this user instead of root.
-g, --group=GROUP
Run with this primary group.
-i, --login
Start a login shell of the target user (like su -).
-s, --shell
Start the shell from $SHELL (keeps more of your environment).
-E, --preserve-env
Keep your environment variables (if the rules allow it).
--preserve-env=LIST
Keep only these variables.
-H, --set-home
Set HOME to the home folder of the target user (default on RHEL).
-D, --chdir=DIR
Run the command in this folder (if allowed).
-R, --chroot=DIR
Change the root folder before running (if allowed).
-b, --background
Run the command in the background.
-P, --preserve-groups
Keep your own group list.
-C, --close-from=NUM
Close all open files from number NUM up.
-T, --command-timeout=TIME
Stop the command after this time (if allowed).
-r, --role=ROLE
SELinux role for the command.
-t, --type=TYPE
SELinux type for the command.
--,
End of sudo options; the rest belongs to the command.

Edit files

-e, --edit
Edit files as sudoedit: a temporary copy is opened in your editor, then copied back.

Check rules

-l, --list
Show what you may run (with a command: check that one).
-U, --other-user=USER
With -l: show the rules of another user (root or allowed users).
-h, --host=HOST
With -l: show rules for another host.

Password and time stamp

-v, --validate
Refresh the time stamp (asks the password) without running a command.
-k, --reset-timestamp
Forget the password now (alone) or for this command.
-K, --remove-timestamp
Remove all time stamps of the user.
-n, --non-interactive
Never ask: fail if a password is needed (for scripts).
-S, --stdin
Read the password from standard input.
-A, --askpass
Use a helper program to ask the password (SUDO_ASKPASS).
-B, --bell
Ring the bell at the password prompt.
-p, --prompt=TEXT
Your own password prompt (%u = user, %h = host).
-N, --no-update
Do not update the time stamp.

Other

-V, --version
Show the version (as root also the settings).
--help
Show help.

Examples 12

$ run as a normal user# run as root (or with sudo)

  1. 1Run one admin command

    sudo dnf install -y httpd
[sudo] password for student:

    Your own password. For the next minutes sudo does not ask again.

  2. 2Get a root shell for many tasks

    sudo -i
whoami
root

    exit when you are done.

  3. 3See what you may run

    sudo -l
User student may run the following commands on server1:
    (ALL) ALL

    (ALL) ALL = full rights (wheel).

  4. 4Check the rules of another user

    sudo -l -U web1

    Test a new rule without logging in as that user.

  5. 5Run a command as another user

    sudo -u postgres psql -c 'select version();'

    Many service tasks must run as the service account.

  6. 6Edit a system file safely

    sudoedit /etc/ssh/sshd_config

    Your editor runs as you; only the save is done as root.

  7. 7Write to a root file from a pipe

    echo "192.168.122.20 server2" | sudo tee -a /etc/hosts

    sudo echo ... >> file fails: the redirect is done by your own shell.

  8. 8Use sudo in a script without hanging

    sudo -n systemctl restart httpd || echo "no rights or a password is needed"

    -n never waits for a password (good for cron and CI).

  9. 9Forget the password at once

    sudo -k

    Use it before you leave your desk.

  10. 10Audit who used sudo (security)

    journalctl _COMM=sudo --since today

    Shows user, folder and command of every sudo call.

  11. 11Find users with full rights

    getent group wheel
wheel:x:10:student,devops1

    Review this list often: everybody here is root.

  12. 12Run a command with a time limit

    sudo -T 5m /usr/local/bin/cleanup.sh

    Only works if the rule allows it (Defaults user_command_timeouts).

Watch out

  • sudo cmd > /root/file fails: use | sudo tee file.
  • A rule that allows an editor, less, find or a shell escape gives full root. Allow exact commands only.
  • With NOPASSWD: a stolen session gives root at once.

Files

/etc/sudoers
The main rules (edit only with visudo).
/etc/sudoers.d/
Extra rule files (one per team or app).
/var/log/secure
Log of sudo use.

Tips to remember

  • Give rights to a group (%webadmins), not to single users.
  • Use full paths in rules and visudo -c after every change.

Exit codes

0 :: The command ran fine (or sudo -l/-v worked). 1 :: sudo error (not allowed, wrong password, bad config). Otherwise the exit code of the command.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man 8 sudo

Open the man page (linux.die.net)www.sudo.ws