So the real way to perform administrative tasks
is using SUDU.
SUDU is more secure to perform these administrative tasks.
And that is because behind SUDU, there's
a sophisticated configuration, which is maintained
in the ETC SUDUers file.
While editing ETC SUDUers through VI SUDU,
the very detailed administration privileges can be assigned.
It goes beyond just running as a route or not.
You can create users with limited access
to specific commands with escalated privileges.
Now, when you are a SUDU-enabled user,
to run an administration task using SUDU,
you SUDU command.
So not user add, but SUDU user add, for instance.
And that will prompt for the current user password
and run the command, but only if that
is allowed through ETC SUDUers.
As already discussed and seen before,
to open a root shell, SUDU minus I can be used.
Now, using SUDU can be complex, specifically
if you have complex commands or composed commands.
While you are using shell meta characters,
SUDU needs a special approach.
Compare the following examples and try
to think about what will be written where.
First, SUDU ls root greater than tilde slash output dot txt,
or SUDU sh minus c ls root greater than tilde slash output
dot txt.
You have any idea?
Let's go check it out.
So SUDU ls slash root greater than tilde slash output dot txt
is prompting for the password.
And what do we see?
We see output dot txt in the current user home directory.
And there we go.
This is the contents of the user root home directory.
Then if you use SUDU sh minus c followed by ls slash root
and greater than tilde slash output dot txt,
then what is the result?
Well, let's do a SUDU cat on slash root slash output dot txt,
where we can see that in the second case,
the output dot txt file has been written to the user root home
directory.
How come?
Well, simple.
Here we have SUDU, and we have the greater than sign,
the shell meta character, which really works as a separator.
So the SUDU applies to ls slash root,
but it does not apply to the tilde and the output dot txt.
So tilde is interpreted as current user home directory.
And if you want everything to be used in the SUDU context,
we use SUDU sh minus c.
And the entire command, including the meta character
between double quotes.
We have seen this before, and this is an important way
to run composed commands in SUDU,
but also in SSH, for instance, as you will see later.