4

How can I disable the passwordless sudo access for the default ubuntu user on an EC2 instance? Is it safe to do it?

Improve this question

3 Answers 3

Reset to default
14

Be sure to either add another user to sudoers first or set a password on the ubuntu account (I would advise the former). Failure to do that could lock you out of sudo on your instance!

So, create a user for yourself, use the ubuntu user to add yourself to sudoers, log back in as yourself and restrict the ubuntu user.

You may notice that the ubuntu user is not actually listed in /etc/sudoers

Check /etc/sudoers.d/90-cloud-init-users

NOTE: Be sure to edit any sudoers file with visudo. e.g.

visudo -f /etc/sudoers.d/90-cloud-init-users

You'll notice a line in that file:

ubuntu ALL=(ALL) NOPASSWD:ALL

You can comment that line out (#) to remove the ubuntu user from sudoers entirely:

# ubuntu ALL=(ALL) ALL

or to require password simply remove the nopasswd section.

ubuntu ALL=(ALL) ALL
Improve this answer
2
  • Make sure you set user ubuntu a password first as by default it is locked and I believe you need sudo privileges to change it. I almost got locked out of sudo, but fortunately I had another user which had sudo privileges added.
    – Yahya Uddin
    Dec 2, 2017 at 22:46
  • 1
    You also do not need to add ubuntu ALL=(ALL) ALL, as ubuntu is already in the sudo group. As long as ubuntu is not removed from the group commenting out is sufficient. But you might want to add this anyway for sanity sake.
    – Yahya Uddin
    Dec 2, 2017 at 23:01
6

Of course you can that. Is it safe? First be sure to set password on user ubuntu.

Edit the sudoers file with command visudo otherwise be very careful. Find the line matching ubuntu user and change it to ubuntu ALL=(ALL:ALL) ALL

  • username is in the beggining of the line
  • first ALL indicates to which hosts it applies (in that case all of them)
  • second ALL is for which user ubuntu can run commands (in that case all of them)
  • third ALL is for which groups ubuntu can run commands (in that case all of them)
  • last but not least ALL means which commands can you run (in that case all of them)

Be sure to chek the manual of sudoers man sudoers. For the first try you can create another user and add it to suders.

Improve this answer
3

Yes, but make sure to set that user's password to something known before you do that.

Improve this answer
2
  • Ok. But how do I do it? What do I need to put into the sudoers file?
    – Shoan
    Jul 24, 2014 at 16:27
  • 2
    @Shoan You just remove NOPASSWD:
    – Michael Hampton
    Jul 27, 2014 at 13:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .