The Secret Superpowers of SUDO

#garyexplains

[SlyEcho]

4:22 visudo is not editing the sudoers directly, it is doing it through a temporary file that is checked for correctness on exiting, this is a protective measure since you may lose admin access if you mess up the file.

[paulalmquist]

I used to teach Unix/Linux system administration. In those days logging in as root was acceptable practice. Then it was log in as an ordinary user then su to root. 2 different passwords had to be known. Now it's log in as ordinary user and sudo with same password. Seems less secure to me. I'm retired now. On my home network I use sudo -i to become root instead of keying sudo for every command. bash history logs all of the commands.

FYI, doing rm -r /* as root is not instantaneous disaster as some claim. It takes a long time to wipe out a system because there are thousands of files to remove.

Of course as root one must ALWAYS work carefully. Make backup of config files before changing them. Document your changes in the config file and a separate log file. For any command that is potentially destructive key your command, read it carefully a couple of times, think about it, edit as necessary, think again before pressing enter. Accuracy comes with practice but never get over confident. Sometimes the fingers, eyes and brain do not correctly coordinate.

I enjoy your videos. Thanks for investing all of those heartbeats into them.

[lorrewatkins]

I just wanted to say thank U Gary ! I learn so much from your vids, and I hope U continue doing these great GE's stuff, because I think I'm not alone learning something new from your vids either novas or power-user, I think there's something to learn from all levels of users, so thanks again Gary and keep up the good vids !

[wallyhare]

And this whole time I just been retyping. Thank you sudo !!

[JanJeronimus]

One important thing of sudo in a multi user system is the logging so you can trace important changes.
However you also should limit commands that can be executed using sudo. Perhaps an idea to explain this in a next video.
Be warned: It is also possible to do something like 'sudo csh' to start a cshell as root.

[cynodont]

Another nice feature is the ability to allow users to execute specific commands as root without a password. For instance on my Debian machine, dmesg can only be used by root (because of the read access on /proc/kmsg) so I have the following sudoers rule to allow my user foobar to do a 'sudo dmesg' without a password:
foobar ALL = (root) NOPASSWD: /bin/dmesg ""
The empty argument "" after dmesg is there to prevent sudo from accepting additional arguments.
WARNING: An attacker could abuse a command argument to read or write protected file.
Other typical uses of that feature are load/unload of kernel modules and also write into protected /sys files (e.g. change the cpufreq governor, flush the disk caches before running a benchmark, ...).

Also, users can run the command 'sudo -l' to get a summary of all relevant sudoers rules.

[aryanghasemi]

Thank you Gary, I love sysadmin-related videos.

Nice! Thanks. I would be interested in a more in depth follow up.

[rubengutierrez]

Great video, I like the way you explain things. thanks Gary! ..question: I Am just starting to learn command lines, are there books or tutorials that you can recommend to really learn how to use command lines?? ... much appreciated.

[DND]

I really enjoyed this... Didn't know sudo was that configurable.

What about the fields with ALL? Can we restrict some commands on specific groups? Or maybe some repositories? I would love a bit more advanced video on sudo

[catsoften]

Did you know that those "incidents" get reported to Santa.

[developerpranav]

Thank you! I wanted to setup a no password sudo account. This made it very easy :D

[johnsimon]

There’s a lot of bits of Unix that make sense if you have a hundred users logged into a single system like the mini computers and dumb terminals of old.

[nitrovenom]

Gary bro, what is task threshold and adaptive lmk?

[anaywalunjkar]

Not a Linux user, but sometimes I use Linux system and use cmd "sudo- su" what is that

[sendgl]

Very interesting, not sure I'll change anything as I am the only Linux user on my network.

[Chalisque]

On machines where security is not important, I like to 'sudo echo "ALL ALL = NOPASSWD: ALL" > /etc/sudoers.d/wideopen'

[MarkKeller]

*GARY!!!*
*Good Evening Professor!*
*Good Evening Fellow Classmates!*

Stay safe out there everyone!

[ivanguerra]

Hey Gary, all this commands shit just look like years 70´s computing for me. When we are going to have implementations by one click on Linux ? Man, this is 21 century !

[codingsaroj]

"sudo !!" will probably be the most useful one for me although I did something like up arrow then home then type "sudo " which is also very fast.

Thanks for revealing the "super" powers.