- The vendor supplied setting,
ALL=(ALL:ALL). Changing this to only allow execution as root may break some assumptions made by people who write software for your platform. Aside from that, it's personal preference.
- Both formats are valid. The format with the colon specifies a group (for use with
sudo -g) in addition to the user.
The effective difference between these two is that
ALL=(ALL:ALL) allows a member of the sudo group to run any command as any user (
sudo -u anyuser) or any group (
sudo -g anyuser).
ALL=(root) format allows members of the sudo group to run any commands as root.
Since giving someone access to the root user is effectively allowing them to run any command that they want, there is no immediately obvious benefit to not letting them run a command as any user or group instead. It enforces an extra level of abstraction to run commands as the other user.
Here is how you'd run a command as
joebob in both scenarios:
sudo -u joebob whoami
sudo sudo -u joebob whoami or
sudo su -c whoami joebob
I would personally prefer
ALL=(ALL:ALL) because it keeps the security logs cleaner, and shows the direct intent of the person invoking the
sudo command in the first line that gets logged.