sudoers file cleanup and consolidation tool/script

Question

I am curious to know what other folks out there might be using to keep the sudoers file in a sane manner. I am looking for a tool, that removes redundant entries, overlapping permissions and/or present sudoers file in a organized way(like sorting by permissions/users/Aliases)

User_Alias RT1123 jappleseed, sjobs
Host_Alias HOST_RT1123 wdc101.domain.com, wdc104.domain.com
Cmnd_Alias .....

Our sudoers file is simple but a lot of entries and it needs to be cleaned up. Does anyone know/have a tool/script to fix/present it ?

Thanks!

Answer 1

i would strongly advise against automatically modifying the /etc/sudoers file, to perform cleanup or whatever. of course, there are probably ways to modify a copy, check for syntactic correctness and then replace the existing file. i just can't quite fathom how large an /etc/sudoers file would have to be that you would need to script it. a competent systems administrator should have no problem keeping the file in line.

if you really must do this, you would want to have a script that does something like this:

#!/bin/sh

if [ `id -u` -ne 0 ]; then
    echo "must be run as root" 1>&2
    exit 1
fi

cp -p /etc/sudoers /etc/sudoers.tmp

# something in here to actually modify the file and dereference the aliases
# and such like you want, working off the COPY, /etc/sudoers.tmp

visudo -qcsf /etc/sudoers.tmp
if [ $? -eq 0 ]; then
   mv /etc/sudoers.tmp /etc/sudoers
else
   print "Failed to update sudoers, syntax of /etc/sudoers.tmp is INCORRECT" 1>&2
   cat /etc/sudoers.tmp && rm -f /etc/sudoers.tmp
   exit 2
fi

but again, i would HIGHLY recommend you spend time configuring your /etc/sudoers files, rather than something potentially dangerous and insecure, like this.

bad scenario; you end up with a non-working sudoers

WORSE scenario; you grant unrestricted sudo access to everyone on your server.