21

I am looking for where the default Amazon AMI linux image sets up the privileges for the default ec2-user account.

After logging in with this account I can use sudo successfully. Checking via the sudoers file, which I open by running visudo (with no other options) I see a few default settings and permissions for root ALL ALL

So ... Where is the permissions for ec2-user assigned?

I have not yet tried to add a new permission but ultimately I want to resign ec2-user for systems management tasks and use a non-full root user for administering the applications (stop and start mysql, httpd, edit apache's vhost files, and upload / edit web content under the web root)

24

It's in /etc/sudoers.d/cloud-init. I, too, delete it from my production systems as soon as I can.

It is included by virtue of the line

#includedir /etc/sudoers.d

in the /etc/sudoers file. Note that, as it says, that leading # isn't treated as a comment sign. On some of my servers, it's also in /etc/sudoers.d/90-cloud-init-users; it may be safest to userdel the ec2-user user.

  • Yes it is. Now why don't you fix your answer so that I can award you the credit? – Johan May 29 '14 at 9:06
  • What on earth were the sudo devs thinking with that #include syntax when the comment character is #? – DaveGauer May 19 '18 at 23:02
  • @DaveGauer it's using the same syntax as a C preprocessor (#include "file" or #include <stdio.h>). But yes, that's a bad choice for a config file. – Tony Cesaro Jun 29 '18 at 21:38
2

Indeed it is a file from /etc/sudoers.d/

From the master sudoers file, the very last part:
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

Specifically the small bit which reads # here does not mean a comment

And then:

[root@webmaster ec2-user]# cd /etc/sudoers.d/
[root@webmaster sudoers.d]# ls -l
total 4
-r--r----- 1 root root 88 May  5 09:16 cloud-init
[root@webmaster sudoers.d]# grep ec2-user *
ec2-user ALL = NOPASSWD: ALL
# User rules for ec2-user
ec2-user ALL=(ALL) NOPASSWD:ALL

Voila.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.