Now another area of problem could be with sudo and privilege escalation.
We can easily check what we're allowed to do with sudo using sudo ‑l,
but very often it's more to do with environment
variables that aren't being passed through.
But we can go through and pass our variables with ‑‑preserve‑env,
and if we want the EDITOR variable kept,
we can go through and add that in.
So here when we're running visudo,
we can then make sure that the EDITOR opens up in our preferred editor.
Another way of doing it, although it's not my preference,
is to go through and add it to the sudo as configuration,
but then, chances are, we would have to then start adding in many variables,
and the idea is that we have a minimum amount of
variables being passed through to sudo, but it is another option.
So let's go through to our command line and just see the
problem and then see how we can resolve it.
We're going to be looking at the EDITOR variable, but it would apply to any
environment variable we wanted passed through. So we're going to be taking a
look at how we invoke our variable passthrough with preserve‑env, but also then
seeing how we could do it with our env_keep.
So here we are back on our Ubuntu 20.04 system. And if I go through then and
do a sudo ‑l, we're able to list what I'm able to do, and we can see then that
I can run all commands without having to enter a password. But also if we look
at the top entry matching default,
we can see then that we are resetting our environment variables, env_reset,
and it's this that most often then starts giving us issues.
Let's just take a look at some of the issues that we might get.
If I go through then and set myself an environment variable, so
I'm setting up then the export of the EDITOR, and I want to use
the vim text editor, my favorite editor.
So with this set, then I might think that I am good to go.
I've set my variable, and of course, it's going to work locally. But the
problem is, as I run through and start setting then my sudo and visudo, then
(wah‑wah‑wah‑wah sound effect) nano has opened up. This isn't what I wanted!
Now, obviously, I can work with nano, but it's going to annoy me, and it does
every single time. So we can fix this, though, very easily. If I go through
then and put in sudo ‑‑preserve‑environment, or env, =, and then the variable
that I want, hit the big Enter key (ba‑dum‑bum‑ching sound effect) and look
at this, it's all working, we're inside vim! I kind of like the idea of doing
it when I need variables going through, but we can configure sudo as well to
allow variables to be passed through.
So this makes it a little bit easier from the user perspective running sudo
because they don't have to put the option in, but then put more work back
on the administrator because we have to configure then the variables that
we're allowing to be passed through.
I'm wanting the editor variable, but other people might want other
variables through, so it can become a little bit painful.
But all we need to do is then just do an env_keep, we can specify that we
append to any other environment variables we are keeping,
so +=, so appending to what we've already previously kept, and then our EDITOR
variable. With this done and dusted, close off your quotes,
hit the big Escape key, and find a good way to save your changes.
So I'm going to use :x to save and exit. And now, of course,
without passing any parameters through or any extra options
through, we're able to get directly into vim.
So there's a couple of ways, and obviously, it becomes your
choice as to how you want to manage it.
I'm also able to see this when I do the sudo ‑l where we can list then our
privileges, and we've got the env_keep=EDITOR. So we can see if there are any
variables that are being retained from my local environment into the sudo
environment. But there you go. We've seen a couple of ways. It becomes your
choice what works for your environment.
But let's now move back to our slides so that we're able to summarize a little of what we've looked at within this module.