Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What is the difference between adding a user to /etc/sudoers and usermod -a -G sudo? Which method should be used for granting sudo?

share|improve this question
6  
For Ubuntu you should very strongly avoid editing the /etc/sudoers under any conditions. Instead add config fragments into the /etc/sudoers.d directory. Using the fragments folder makes upgrading easier since you modified a conffile. –  Zoredache Jun 10 '14 at 20:08
    
@Zoredache - excellent point. Do you care if I add that to my answer? I don't want to take credit for it, but this tip should live in an answer somewhere in case the comment gods nuke this for some reason. –  EEAA Jun 10 '14 at 20:12
2  
@EEAA, I grant you permission to use the above, and anyother comments I post to merge into actual answers. I add comments because I am too lazy/busy to add a full answer, but I don't mind at if people take my comments and integrate them into a complete good answer. –  Zoredache Jun 10 '14 at 20:17
    
@Zoredache Thanks! –  EEAA Jun 10 '14 at 20:26

3 Answers 3

up vote 19 down vote accepted

If you can avoid it, never grant sudo privileges to individual users. Always grant privilegs to a group and then add users to that group.

For ubuntu-based servers, instead of adding lines to /etc/sudoers, add config file fragments into /etc/sudoers.d. This is more flexible, easier to understand, more resilient in the face of upgrades, and works better with systems managed by configuration management systems.

NOTE: never edit /etc/sudoers directly. Instead, use visudo, which will perform syntax checking on your edits, preventing you from breaking your sudo config with invalid syntax.

share|improve this answer
    
why not add the group to /etc/sudoers? –  Flak DiNenno Jun 10 '14 at 19:42
1  
@FlakDiNenno - right, that is exactly what I suggested. –  EEAA Jun 10 '14 at 19:47
    
ahhh... I thought you were referring to the usermod -a -G sudo –  Flak DiNenno Jun 10 '14 at 19:50
    
+1 for the warning about using visudo instead of direct edit –  Flak DiNenno Jun 10 '14 at 19:51
    
Good point about visudo. Some people don't realize there's a reason that /etc/sudoers is marked as read-only. –  ub3rst4r Jun 11 '14 at 2:27

I just found this little tidbit out there... seems you need to be particularly careful with using the -G option in Ubuntu, in particular in combination -g option. So:

  1. Use usermod -aG to add the user(s) to a group.
  2. Then as @EEAA suggested, add the group to the /etc/sudoers file using the $ sudovisudo command (automatically invokes a privileged editor with syntax checking).

Here's the info about the -aG option on Ubuntu, taken from here http://ubuntuforums.org/showthread.php?t=1240477:

'I'm reading the Wiley "Linux Command Line and Scripting Bible" - and they said that usermod -G "appends" a group to whatever user account you are modifying. I found this to be false in Ubuntu, don't know if it's just different in other distro's, or a typo in the book. It removes you from EVERY other group you belong to, except your default user group (modified by the -g option). I managed to remove myself from the admin group and could no longer sudo anything. Thank goodness for recovery mode...'

The correct option is usermod -aG. Lesson learned...

share|improve this answer
2  
can the downvoter have the courtesy to provide some constructive criticism here. tia. –  Flak DiNenno Jun 10 '14 at 20:08
    
I didn't downvote you, but your 'answer', doesn't really answer the question asked. This is a pretty strict Q&A site, we generally expect answers to directly address the question asked. BTW, yes I know you somewhat address the question a bit, but your 'answer' seems most saying do what EEAA said, but be warned about this weird quirk. –  Zoredache Jun 10 '14 at 20:10
    
@Zoredache thanks for taking the time. Doesn't step 1 & 2 clearly give instructions for "a preferred method for granting sudo"? Which is what the OP asked? –  Flak DiNenno Jun 10 '14 at 20:11

You don't tell us how big your environment is, but if it's more than one machine you may also want to consider configuring sudo using LDAP s an alternative to editing sudoers locally (either through visudo or using the /etc/sudoers.d fragments method).

LDAP configuration is a well-tested way of making sure that multiple machines have the same sudo configuration, and presents a nice unified environment (with central management of an important authorization mechanism). As a bonus if you already use LDAP (or AD) for authentication/authorization in your environment you can take advantage of the existing infrastructure (and if you don't you should seriously consider it - centralization has many benefits).

Everything folks have already said in the other answers about creating authorized groups still stands - it's easier as you scale up to grant privileges to a group and manage group membership than it is to deal with managing rights for individual users.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.