Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just installed sudo on my machine (Debian Wheezy).

While I was editing the sudoers file using visudo, I noticed this line:

%sudo   ALL=(ALL:ALL) ALL

On several tutorials and blogs (although often based on Squeeze), here is what is recommended:

%sudo   ALL=(root) ALL
  1. Ideally, which one (if one of them) should I use?
  2. Does the first one mean that any user in the sudo group would be able to run commands as any of the other users of the machine?
  3. Does the latest format still apply on Wheezy or is there a newer way to do that, like for example using colons?

Thanks :-)

share|improve this question

1 Answer 1

up vote 3 down vote accepted
  1. The vendor supplied setting, ALL=(ALL:ALL). Changing this to only allow execution as root may break some assumptions made by people who write software for your platform. Aside from that, it's personal preference.
  2. Correct.
  3. Both formats are valid. The format with the colon specifies a group (for use with sudo -g) in addition to the user.

The effective difference between these two is that ALL=(ALL:ALL) allows a member of the sudo group to run any command as any user (sudo -u anyuser) or any group (sudo -g anyuser). ALL=(root) format allows members of the sudo group to run any commands as root.

Since giving someone access to the root user is effectively allowing them to run any command that they want, there is no immediately obvious benefit to not letting them run a command as any user or group instead. It enforces an extra level of abstraction to run commands as the other user.

Here is how you'd run a command as joebob in both scenarios:

ALL=(ALL:ALL) -- sudo -u joebob whoami

ALL=(ROOT) -- sudo sudo -u joebob whoami or sudo su -c whoami joebob

I would personally prefer ALL=(ALL:ALL) because it keeps the security logs cleaner, and shows the direct intent of the person invoking the sudo command in the first line that gets logged.

share|improve this answer
    
I've updated my answer for #1 to reflect the fact that changing the existing setting would be applying a more restrictive setting and changing the vendor supplied default. –  Andrew B Mar 17 '13 at 17:21
    
Alright, thanks!! (I wanted to upvote your answer but I don't have enough reputation... grrr!) –  Jérémie Astori Mar 17 '13 at 17:30
    
I actually thought that if I replaced "all:all" with "root", no one could pretend to be me and, I dont know, change my password (for instance). Is there a "better" way (yup, real newbie) to say "ok, I want to be the main administrator, and I also want to give root privileges to sudo group members", or is my request meaningless? –  Jérémie Astori Mar 17 '13 at 17:30
    
Allowing unrestricted access to running commands as root is giving them limitless power. You can only accomplish what you're describing if you're limiting those people to running very specific commands as root. Otherwise they can change passwords, run any command as any user, etc. –  Andrew B Mar 17 '13 at 17:34
    
OK, thanks for the clarification, very clear! –  Jérémie Astori Mar 17 '13 at 17:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.