Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

so I have a user running sudo and they are in both wheel and other_group. other_group shouldn't need a password but wheel does. My question is : does wheel requiring a password for sudo negate the fact that other_group doesn't need a password?

heres a snippet from running sudo visudo:

## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL

## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

## Allows members of the users group to mount and unmount the
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

%other_group        ALL=(ALL)       NOPASSWD: ALL
share|improve this question

1 Answer 1

up vote 3 down vote accepted

Normally the last match wins for sudo. From the sudoers man page

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

Are you absolutely sure that the user is in both groups ?

On a Centos system I have to hand this works as expected

%wheel  ALL=(ALL)       ALL
%other_group    ALL=(ALL) NOPASSWD: ALL

No password required because other_group is after wheel.

%other_group    ALL=(ALL) NOPASSWD: ALL
%wheel  ALL=(ALL)       ALL

Asks for a password as wheel is after other_group.

share|improve this answer
    
I was hoping someone would say that. Let me test out that proposed behavior –  Rooster Oct 11 '13 at 14:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.