Lab 6.2: Give limited admin rights with sudo

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Doel

Give one user full admin rights and give a team only the commands it needs. Test both, and make sure the sudo files have no errors.

Work on server1 as root (sudo -i).
The web server does not need to be installed: sudo checks the rule before the command runs.

Create the user devops1 with full admin rights through sudo.
Create the group webadmins and the user web1 as a member of it.
Members of webadmins may run only these commands as root: systemctl restart httpd, systemctl status httpd and journalctl -u httpd. Put the rule in its own file.
Create the user backup1. It may run /usr/bin/rsync as root without a password.
Test as web1: list the allowed commands, run one allowed command and try cat /etc/shadow with sudo (this must fail).
Check that all sudo files have a correct syntax.

#sudo -l -U web1
#sudo -l -U backup1
#su - web1 -c 'sudo -n cat /etc/shadow'
#visudo -c

Toon de hints

Toon de oplossing

devops1 in wheel.

#useradd -G wheel devops1
#passwd devops1

Group and user.

#groupadd webadmins
#useradd -G webadmins web1
#passwd web1

A rule file for the group.

#visudo -f /etc/sudoers.d/webadmins

/etc/sudoers.d/webadmins

%webadmins ALL=(root) /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd, /usr/bin/journalctl -u httpd

backup1 without a password for rsync.

#useradd backup1
#visudo -f /etc/sudoers.d/backup1

/etc/sudoers.d/backup1

backup1 ALL=(root) NOPASSWD: /usr/bin/rsync

Test as web1.

#su - web1
$sudo -l
$sudo systemctl status httpd
$sudo cat /etc/shadow
$exit