1. Sudoers Meryll Larkin - that's me Why you are here:
You do this at work or want to
General curiosity - want to learn
Your first choice workshop was full
To heckle
Any burning questions you need answered?
I'll make sure to get to them.

2. Sudoers Examples and discussion style workshop
I've seen some bad sudoers files and I know how to do better, but I'm not an “expert” - ok for you to help/suggest
Why do we need to write good sudoers files?
Your ideas,
Examples and analysis/critiques

3. Why Sudoers What do we do if we don't use sudoers?
What role does sudoers play in security?
Most common form of bad sudoers?

4. Sudo Aptonym
Linux developers knew commands were hard to remember so they tried to make them memorable.
Pseudo - masquerading as someone else
SU - do = What the SuperUser does

5. Wheel Group What is the wheel group and how is it used?
What is the gid of the wheel group?
Does it have to be the “wheel” group?

6. How to think about Sudo Specify what a user or group CAN do
Set limits as to what a user or group CAN'T do (trickier): Because there are so many way to accomplish something in Linux.
CLI examples here. Why we would want to do those things

7. Discuss Assorted Sudo Strategies
Per-administrator, additional admin accounts: nuhura, nuhura_adm
Shared accounts for shared work
root does not have ssh permission, but you need to run remote scripts with root authority
difference between su and su -
if you can become root, you can become any login.

8. Writing Sudoers Rules Permissions on /etc/sudoers file
aliases & privilege specs in sudoers
4 types of aliases
User_Alias,
Runas_Alias,
Host_Alias,
Cmnd_Alias.
Default for each alias type
what is /etc/sudoers.d/ ?

9. Writing Sudoer Rules, More
principle of least privilege:
This is a User Spec (privilege) template:
User Host = Command(s) [: Hosts = Cmnd_Spec_List *]
Commands (and command Cmnd_Spec_Lists) can be single commands (absolute path is best) or a comma separated list.
Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd
Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'

10. Writing Sudoer Rules, More 2
SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' | 'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' | 'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')
Cmnd_Spec_List ::= Cmnd_Spec | Cmnd_Spec ',' Cmnd_Spec_List
Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd

11. Developing Rules & Testing
TRY IT!!!!
Become an unprivileged user, see if you can do your work.
Deputize a dev to show you exactly the steps she takes.
Don't test on production machines!
Test what you DON'T want to happen as well as what you do!

12. sudo dangers “elevation of privileges” show them
unintentional file deletion or alteration
one strategy: greatly restrict who has sudo on Production systems. Allow more sudo access on Dev, Test, and/or Staging hosts.

13. Sudoers, End
Thanks for your attention and especially your participation!
I created a few scripts so to give you a “sample set” of users so you can try out permissions and how they work on your own laptop or test machine. They should found in the same place where you downloaded this presentation.
Happy hacking!