Understanding Sudoers Configuration

Introduction

In Linux, the root user has unlimited power over the system. However, logging in as root for daily work is dangerous. Instead, we use sudo, which allows regular users to run specific commands with elevated privileges.

The file that controls who can use sudo and what they can do is /etc/sudoers. This is one of the most sensitive policy files on a Linux system because it defines delegated administrative power.

Managing this file requires extreme care. A single syntax error can lock everyone (including administrators) out of the system. For this reason, you must never edit this file directly with a standard text editor. Instead, we use a special tool called visudo.

This is a policy file, not just a convenience setting. It defines who may borrow administrative power, under what conditions, and for which commands.

In this lab, you will learn how to:

Safely inspect the sudoers configuration using visudo.
Grant administrative privileges to a user.
Verify that the privileges are working correctly.

Assess Current Privileges

Before making changes, let's verify the current state. We have created a standard user named alex for this lab. By default, new users do not have administrative privileges.

Inspect the Sudoers File

To view the configuration, we use visudo. This tool locks the file and validates syntax before saving, preventing accidental lockouts.

That validation step is the reason visudo exists. With ordinary text editors, a small typo might only be discovered after the file is saved and sudo access is already broken.

View the current configuration:

sudo visudo

You will see lines defining who has privileges. For example:

root    ALL=(ALL:ALL) ALL
%admin ALL=(ALL) ALL
%sudo   ALL=(ALL:ALL) ALL

In this environment, visudo opens the file in the nano editor. Press Ctrl+X to exit without changing anything.

Verify Lack of Access

Now, let's switch to the user alex and attempt to perform an administrative task.

First, switch to user alex:

su - alex

(Enter password when prompted).

Then, try to list the contents of the restricted /root directory:

sudo ls /root

(Enter password when prompted).

Observe the error:

alex is not in the sudoers file.  This incident will be reported.

This confirms that alex is a standard user and cannot perform administrative actions.

That is the secure default. In Linux security, starting with fewer privileges and granting only what is needed is part of the principle of least privilege.

Finally, return to your original user (labex):

exit

Configure User Privileges

To grant alex the ability to run commands as root, we need to add a rule to the /etc/sudoers file.

First, open the file safely:

sudo visudo

Scroll to the end of the file (or look for the "User privilege specification" section) and add the following line:

alex    ALL=(ALL:ALL) ALL

Breakdown of the rule:

alex: The username to grant privileges to.
The first ALL: The rule applies to connections from any Host.
(ALL:ALL): The user can run commands as any User (e.g., root) and any Group.
The final ALL: The user can run Any Command.

This rule is intentionally broad for teaching purposes. In real systems, administrators often prefer narrower sudo rules that allow specific commands instead of full unrestricted access.

Finally, save and exit:

Press Ctrl+O, then Enter to save.
Press Ctrl+X to exit.

If you had made a typo, visudo would have warned you, preventing a broken configuration.

Verify Updated Privileges

Now that we have updated the configuration, alex should have full administrative rights. Let's verify this.

First, switch to the alex user:

su - alex

Then, attempt the privileged command again:

sudo ls /root

(Enter password if prompted).

Observe the result. You should now see the contents of the /root directory (likely empty or containing a few implementation files), without any access denied errors.

snap

This confirms that you have successfully elevated privileges for the user alex.

At that point, alex still is not root by default. Instead, alex has been delegated the ability to request elevated execution through sudo, which is safer and more auditable than regular root login.

Finally, exit the alex session:

exit

Summary

In this lab, you learned how to manage user privileges safely.

Key Takeaways:

Safety First: Always use visudo to edit /etc/sudoers. Never edit it directly.
Privilege Delegation: You can grant specific users root access without sharing the root password.
Verification: Always test new privileges to ensure they work as intended.

Mastering sudoers configuration allows you to build a secure system where users have exactly the permissions they need—no more, no less.