visudo

What it does

How to write it

visudo [OPTION]... [[-f] FILE]

Main parts

%group

A group name in a rule (users without %).

ALL

Any host / any user / any command (by position).

(root)

The user the command runs as.

NOPASSWD:

Do not ask for a password for the commands after it.

Defaults

A setting line, like Defaults timestamp_timeout=10.

User_Alias, Cmnd_Alias

Names for lists of users or commands.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Edit the main file

   #visudo

   Opens /etc/sudoers with locking and a syntax check.

2. 2Create a rule file for a team

   #visudo -f /etc/sudoers.d/webadmins

   Put the rule in a separate file: updates of the sudo package do not touch it.

3. 3Allow a group only some commands

   #cat /etc/sudoers.d/webadmins
   %webadmins ALL=(root) /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd

   The content of the file. Use full paths.

4. 4Allow one command without a password

   #cat /etc/sudoers.d/backup1
   backup1 ALL=(root) NOPASSWD: /usr/bin/rsync

   For a backup job that runs from cron.

5. 5Check all files after a change

   #visudo -c
   /etc/sudoers: parsed OK
   /etc/sudoers.d/webadmins: parsed OK

   Run it after every change, also after a config tool wrote the file.

6. 6Check one file before you install it

   #visudo -cf /tmp/newrule

   Test a file from Ansible or a colleague before you copy it into sudoers.d.

7. 7Strict check with owner and permissions

   #visudo -c -s -O -P

   A file with wrong permissions is skipped by sudo.

8. 8Use nano instead of vi

   #EDITOR=nano visudo

   Works when env_editor is allowed (default).

9. 9Make the password last longer

   #echo 'Defaults timestamp_timeout=15' > /etc/sudoers.d/timeout; visudo -c

   sudo asks again after 15 minutes. 0 = ask every time.

10. 10Log all sudo input and output (audit)

    #echo 'Defaults log_output' > /etc/sudoers.d/iolog; visudo -c

    Sessions are saved in /var/log/sudo-io; replay them with sudoreplay.

11. 11Use command aliases for clear rules

    #cat /etc/sudoers.d/web
    Cmnd_Alias WEB = /usr/bin/systemctl restart httpd, /usr/bin/systemctl reload httpd
    %webadmins ALL=(root) WEB

    One name for a list of commands.

Nothing matches this filter.

Files

/etc/sudoers

The main file (has #includedir /etc/sudoers.d or @includedir).

/etc/sudoers.d/

Extra rule files.

Exit codes