> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/sudo-command.md).
# SUDO Command
The `sudo` (Superuser Do) command in Linux allows a permitted user to execute a command as another user, typically the root user. It is commonly used to execute administrative tasks without logging in as root.
***
### **Sudo Management File**
Sudo privileges and rules are managed through the `/etc/sudoers` file.
#### **Editing the Sudoers File**
Directly editing `/etc/sudoers` can lead to syntax errors, potentially locking out administrative access. Instead, use:
| Command | Description |
| ------------------- | -------------------------------------------------- |
| `vim /etc/sudoers` | Edits the file but does not detect syntax errors. |
| `EDITOR=vim visudo` | Safely edits the file while checking for mistakes. |
***
### **Understanding the Sudoers File**
The `/etc/sudoers` file follows a specific syntax for defining user privileges.
#### **1. Defaults secure\_path**
```
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
```
* Ensures `sudo` runs commands only from a specified set of directories.
* Prevents execution of malicious scripts placed in untrusted paths.
***
#### **2. User Privilege Definition**
A basic entry in the sudoers file follows this format:
```
=(:)
```
| Section | Meaning |
| -------------- | ------------------------------------------------------- |
| `root` | User who gets sudo privileges. |
| `ALL` (first) | Specifies the hostname (applies to all hosts). |
| `ALL` (second) | Defines the user or group under which the command runs. |
| `ALL` (third) | Specifies the allowed commands (ALL = any command). |
**Example**
```
root ALL=(ALL:ALL) ALL
```
* Root user can execute **any** command on **any** host with **any** user or group privileges.
***
#### **3. Granting Sudo Access to a Group**
Instead of assigning sudo privileges individually, a group can be given access.
| Symbol | Meaning |
| -------- | ---------------------------- |
| `%` | Indicates a group. |
| `%wheel` | Refers to the `wheel` group. |
**Example**
```
%wheel ALL=(ALL) ALL
```
* Any user in the `wheel` group can execute **all** commands as **any user** on **any host**.
***
### **Using Aliases in Sudoers**
Aliases help manage sudo permissions efficiently by grouping users, hosts, or commands.
### **Host Aliases**
Defines groups of hostnames.
**Example**
```
Host_Alias FILESERVERS = fs1, fs2
```
* Creates an alias `FILESERVERS` for two hosts: `fs1` and `fs2`.
***
### **User Aliases**
Groups multiple users under a single alias.
**Example**
```
User_Alias ADMINS = jsmith, jdoe
```
* Defines `ADMINS` as an alias for users `jsmith` and `jdoe`.
***
### **Command Aliases**
Groups frequently use commands under a single name.
**Example**
```
Cmnd_Alias DISK_COMMANDS = /sbin/fdisk, /sbin/mkfs
```
* Defines `DISK_COMMANDS` to include disk-related commands.