In this lesson, you will learn how to grant users granular administrative power using the sudoers framework without handing them the keys to the entire kingdom.
The Principle of Least Privilege
The root user has absolute control over a Linux system, but letting every administrator log in as root is a security nightmare. If you need a user to perform a specific task—like restarting a web server—you shouldn't give them a full shell with root privileges. Instead, you use the sudoers framework to delegate specific commands.
Configuring Sudoers
The configuration for sudo is held in /etc/sudoers. You should never edit this file directly with a standard text editor. Always use the visudo command. visudo performs a syntax check before saving, preventing you from accidentally locking yourself out of administrative access due to a typo.
To delegate specific access, you add a line to the visudo file using the following syntax:
username host = (user:group) command
For example, if you want a user named alice to be able to restart the Nginx web service without needing a root shell, you would add this entry:
alice ALL = (root) /usr/bin/systemctl restart nginx
Here is the breakdown:
alice: The user being granted the right.ALL: The host(s) where this rule applies.(root): The user identity the command will run as./usr/bin/systemctl restart nginx: The absolute path to the only command Alice is allowed to execute with elevated privileges.
Why This Matters
When Alice types sudo /usr/bin/systemctl restart nginx, the system verifies her identity and executes only that specific command. If she tries to run /bin/bash or any other unauthorized command, the system will deny her. This approach minimizes the blast radius of a compromised account and provides a clear audit trail of who performed specific maintenance tasks.
By restricting access to specific binaries, you ensure that administrative duties are performed predictably and securely, keeping the core system integrity intact.
Key Takeaway: Use visudo to grant specific command-level access to non-root users, adhering to the principle of least privilege rather than granting blanket administrative rights.