Now another way, and another far more flexible way of gaining administrative
privileges is using sudo. The default configuration file we will need
privileges to look at, so as our vagrant user has privileges by default, we
can go through and list the contents of the etc and sudoers file. As well as
this, though, there is an extension directory, and we can look inside of
that extension directory etc/sudoers.d. It's here where we're likely to see
for vagrant boxes the configuration that is being used by the vagrant user.
The idea is with sudo we don't need to know the target password,
we can authenticate with our own password or perhaps even without a password.
We can also choose the tasks that we're able to run with sudo.
We don't need full administrative privileges.
When we take a look at editing the sudoers file,
a slip of your typing fingers can break access to the sudoer system,
so we need to make sure that we edit accurately.
One way of doing so is using visudo to do your edit. This will
open up in an editor, often on Red Hat Enterprise Linux. It is
going to be the Vim text editor.
If we're looking at using something like Ubuntu, it's more likely to
be nano that it opens up by default. But it does a syntax check at the
end, so if we've got anything incorrect,
we can change those entries before they are saved and
potentially breaking our system. Even if we're writing to the
nonstandard file, we can use visudo ‑f so we are then specifying
the file that we want to write to.
It is really important that we do use something like visudo so we know then
that the syntax is going to be correct before we make saves. To see some
possible entries, we've got an entry here for tux.
We're saying that the tux user, when connecting from the 192.168.33.13 system,
is allowed to sudo to root.
He doesn't have to set in a password for all commands, so he can run any
administrative command without having to put in a password, but only if
he is connecting from the .13 system. Here with a percent in front of
the name, this is indicating a group. The group wheel is allowed to
connect from all systems.
It can sudo as root and run all commands, but we don't have the NOPASSWD,
so they're going to have to enter their password. When we look at the
configuration for the helpdesk group, again,
it's %helpdesk so it's a group, they can connect from any system to sudo as the
root user, but they're only allowed to run the passwd command, and they can't
run the passwd command, so !/usr/bin/passwd with the argument of root; they're
not allowed to change the root password.
Now having seen some examples in the slides,
why don't we find a command line and exercise our typing fingers so we can learn how to do this for ourselves.