And yes, congratulations.
You now know how to elevate privileges within Linux. And this is really
important to your career and to your exam perspectives.
So we've been looking at privilege escalation, which can include the su
command. And don't forget with su, we also have su‑, which is exactly the
same as su ‑l, giving us a full login shell rather than just su, which
doesn't set all of our environment.
The problem is using su is that we have to know the password of the target user.
That's not a good thing as far as the root account is concerned. Using sudo,
we're going to be prompted for our own password and this generally is more
secure, but we're also able to delegate parts of the administration rather
than the complete administration tasks to users. We edit the configurations
with visudo, so we get the syntax check at the end. But it's very important,
as we've shown you, to make sure that we fully understand the way to answer
those syntax checks at the end. If we want to edit the nonstandard file,
so the standard file would be etc/sudoers, but if we want to add
something, let's say, to our sudoers.d directory,
we can use the option ‑f with visudo. We could also, if we
wanted to check a configuration file, just run our checks,
we could run visudo‑c. If we need to then specify a different
file, again, we can use ‑c and ‑f together.
If we want to keep things such as our editor, the environment is
reset using sudo. So to maintain the editor,
we can set our editor variable and ensure that we have
defaults env_keep += EDITOR to ensure that it is passed
through to the sudo environment.
And then we finished up by taking a look at polkit. Now whilst it
does seem a little bit complex and we'd be thinking why would we
use it, we showed how we could use it to recover from a failed
edit to our sudo system.
The main tools that we've got is pkexec to run our commands, but
the command line authenticator is our pkttyagent.
So I really hope you got something from this and you learned something new.
It's always good if from every video you watch you can take away something new.
So I'm really hoping you've got lots out of this.
But don't worry, we're not finished just yet.
In our next module, we're going to be taking a look at how we can start managing our local users.