DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Linux Configure sudo

#linux

We have some users on all app servers in Stratos Datacenter. Some of them have been assigned some new roles and responsibilities, therefore their users need to be upgraded with sudo access so that they can perform admin level tasks.

a. Provide sudo access to user siva on all app servers.

b. Make sure you have set up password-less sudo for the user.

Solution

Step 1: Connect to Each App Server and Configure sudo

App Server 1 (stapp01) - User: tony 

ssh tony@stapp01
# Password: Ir0nM@n
sudo su -
# Password: Ir0nM@n
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva
exit
exit
Enter fullscreen mode Exit fullscreen mode

App Server 2 (stapp02) - User: steve 

ssh steve@stapp02
# Password: Am3ric@
sudo su -
# Password: Am3ric@
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva
exit
exit
Enter fullscreen mode Exit fullscreen mode

App Server 3 (stapp03) - User: banner 

ssh banner@stapp03
# Password: BigGr33n
sudo su -
# Password: BigGr33n
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva
exit
exit
Enter fullscreen mode Exit fullscreen mode

One-Line Commands

App Server 1 (stapp01): 

echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'echo \"siva ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/siva && chmod 440 /etc/sudoers.d/siva'"
Enter fullscreen mode Exit fullscreen mode

App Server 2 (stapp02): 

echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'echo \"siva ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/siva && chmod 440 /etc/sudoers.d/siva'"
Enter fullscreen mode Exit fullscreen mode

App Server 3 (stapp03): 

echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'echo \"siva ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/siva && chmod 440 /etc/sudoers.d/siva'"
Enter fullscreen mode Exit fullscreen mode

Using Heredoc (Recommended)

App Server 1: 

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "=== Configuring sudo for siva on stapp01 ==="
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva
echo "Verification:"
cat /etc/sudoers.d/siva
ls -la /etc/sudoers.d/siva
visudo -c
'
EOF
Enter fullscreen mode Exit fullscreen mode

App Server 2: 

ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "=== Configuring sudo for siva on stapp02 ==="
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva
echo "Verification:"
cat /etc/sudoers.d/siva
ls -la /etc/sudoers.d/siva
visudo -c
'
EOF
Enter fullscreen mode Exit fullscreen mode

App Server 3: 

ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "=== Configuring sudo for siva on stapp03 ==="
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva
echo "Verification:"
cat /etc/sudoers.d/siva
ls -la /etc/sudoers.d/siva
visudo -c
'
EOF
Enter fullscreen mode Exit fullscreen mode

Automated Script (Run from Jump Host) 

#!/bin/bash

echo "========================================="
echo "Configuring Password-less sudo for siva"
echo "========================================="

declare -A SERVERS=(
    ["stapp01"]="tony:Ir0nM@n"
    ["stapp02"]="steve:Am3ric@"
    ["stapp03"]="banner:BigGr33n"
)

for server in "${!SERVERS[@]}"; do
    IFS=':' read -r user pass <<< "${SERVERS[$server]}"
    echo ""
    echo "=== $server ($user) ==="

    ssh "$user@$server" << EOF
echo '$pass' | sudo -S bash -c '
echo "Configuring sudo for siva..."
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva

echo "Verification:"
echo "  File: \$(cat /etc/sudoers.d/siva)"
echo "  Permissions: \$(ls -la /etc/sudoers.d/siva | awk \"{print \\\$1}\")"
echo "  Syntax: \$(visudo -c 2>&1 | head -1)"
'
EOF
done

echo ""
echo "========================================="
echo "✅ Password-less sudo configured for siva"
echo "========================================="
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands 

# Connect to stapp01
ssh tony@stapp01
# Password: Ir0nM@n

# Become root
sudo su -
# Password: Ir0nM@n

# Step 1: Create sudoers file for siva
echo "=== Creating sudoers file for siva ==="
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva

# Step 2: Set correct permissions
echo "=== Setting permissions ==="
chmod 440 /etc/sudoers.d/siva

# Step 3: Verify contents
echo "=== File contents ==="
cat /etc/sudoers.d/siva

# Step 4: Check permissions
echo "=== File permissions ==="
ls -la /etc/sudoers.d/siva

# Step 5: Validate sudoers syntax
echo "=== Validating syntax ==="
visudo -c

# Step 6: Test as siva user (if exists)
echo "=== Testing sudo access ==="
su - siva -c "sudo whoami" 2>/dev/null || echo "siva user not found or test failed"

# Exit
exit
exit
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp01 ~]# echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
[root@stapp01 ~]# chmod 440 /etc/sudoers.d/siva

[root@stapp01 ~]# cat /etc/sudoers.d/siva
siva ALL=(ALL) NOPASSWD: ALL

[root@stapp01 ~]# ls -la /etc/sudoers.d/siva
-r--r----- 1 root root 30 Sep 11 10:00 /etc/sudoers.d/siva

[root@stapp01 ~]# visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/siva: parsed OK

[root@stapp01 ~]# su - siva -c "sudo whoami"
root
Enter fullscreen mode Exit fullscreen mode

Verification Commands 

# 1. Check sudoers file exists
ls -la /etc/sudoers.d/siva

# 2. Check file contents
cat /etc/sudoers.d/siva

# 3. Check file permissions (should be 440)
stat -c "%a %U:%G %n" /etc/sudoers.d/siva

# 4. Validate sudoers syntax
visudo -c

# 5. Test sudo access as siva
su - siva -c "sudo whoami"
# Expected: root

# 6. Check sudo privileges
su - siva -c "sudo -l"
# Expected: (ALL) NOPASSWD: ALL

# 7. Verify on all servers
for server in stapp01 stapp02 stapp03; do
    echo "=== $server ==="
    ssh tony@$server "sudo cat /etc/sudoers.d/siva"
done
Enter fullscreen mode Exit fullscreen mode

Understanding the sudoers Configuration

Syntax Breakdown 

siva ALL=(ALL) NOPASSWD: ALL
Enter fullscreen mode Exit fullscreen mode
Component Meaning
siva Username
ALL Hosts (all hosts)
(ALL) Run as user (all users)
NOPASSWD: No password required
ALL Commands (all commands)

File Permissions

Permission Value Description
440 r--r----- Read-only for owner and group
Owner root Root user
Group root Root group

Why Use /etc/sudoers.d/

  • Cleaner than editing /etc/sudoers directly
  • Easier to manage individual user configurations
  • Less risk of breaking the main sudoers file
  • Files are automatically included if syntax is correct

Alternative Methods

Method 1: Using visudo to create file 

visudo -f /etc/sudoers.d/siva
# Add: siva ALL=(ALL) NOPASSWD: ALL
# Save and exit
Enter fullscreen mode Exit fullscreen mode

Method 2: Using tee command 

echo "siva ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/siva
sudo chmod 440 /etc/sudoers.d/siva
Enter fullscreen mode Exit fullscreen mode

Method 3: Using printf 

printf "siva ALL=(ALL) NOPASSWD: ALL\n" | sudo tee /etc/sudoers.d/siva
sudo chmod 440 /etc/sudoers.d/siva
Enter fullscreen mode Exit fullscreen mode

Method 4: Append to main sudoers file (not recommended) 

echo "siva ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "siva is not in the sudoers file": 
   # Check if file was created
   ls -la /etc/sudoers.d/siva
   # Check contents
   cat /etc/sudoers.d/siva
Enter fullscreen mode Exit fullscreen mode
  1. "sudo: /etc/sudoers.d/siva is mode 0644, should be 0440": 
   # Fix permissions
   chmod 440 /etc/sudoers.d/siva
Enter fullscreen mode Exit fullscreen mode
  1. "syntax error near line 1": 
   # Check syntax
   visudo -c
   # Fix the line
   echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
Enter fullscreen mode Exit fullscreen mode
  1. "siva user does not exist": 
   # Create the user first
   useradd siva
   # Then configure sudo
   echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
   chmod 440 /etc/sudoers.d/siva
Enter fullscreen mode Exit fullscreen mode
  1. "Permission denied" when creating file: 
   # Use sudo or become root
   sudo su -
Enter fullscreen mode Exit fullscreen mode
  1. File not being read: 
   # Check if sudoers.d is included in main sudoers
   grep includedir /etc/sudoers
   # Should show: #includedir /etc/sudoers.d
Enter fullscreen mode Exit fullscreen mode

Complete Script (Run from Jump Host) 

#!/bin/bash

echo "========================================="
echo "Configuring Password-less sudo for siva"
echo "========================================="

declare -A SERVERS=(
    ["stapp01"]="tony:Ir0nM@n"
    ["stapp02"]="steve:Am3ric@"
    ["stapp03"]="banner:BigGr33n"
)

for server in "${!SERVERS[@]}"; do
    IFS=':' read -r user pass <<< "${SERVERS[$server]}"
    echo ""
    echo "=== $server ($user) ==="

    ssh "$user@$server" << EOF
echo '$pass' | sudo -S bash -c '
echo "Creating sudoers file..."
echo "siva ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/siva
chmod 440 /etc/sudoers.d/siva

echo "Verifying..."
echo "  Content: \$(cat /etc/sudoers.d/siva)"
echo "  Permissions: \$(stat -c "%a" /etc/sudoers.d/siva)"
echo "  Syntax check: \$(visudo -c 2>&1 | grep siva)"

if id siva &>/dev/null; then
    echo "  Sudo test: \$(su - siva -c "sudo whoami" 2>/dev/null)"
else
    echo "  Note: siva user does not exist yet"
fi

echo "✓ Configuration complete on $server"
'
EOF
done

echo ""
echo "========================================="
echo "✅ Password-less sudo configured for siva"
echo "========================================="
echo ""
echo "Verification commands:"
echo "  ssh tony@stapp01 'sudo cat /etc/sudoers.d/siva'"
echo "  ssh steve@stapp02 'sudo cat /etc/sudoers.d/siva'"
echo "  ssh banner@stapp03 'sudo cat /etc/sudoers.d/siva'"
Enter fullscreen mode Exit fullscreen mode

Summary

  • ✅ sudoers file created: /etc/sudoers.d/siva on all servers
  • ✅ Configuration: siva ALL=(ALL) NOPASSWD: ALL
  • ✅ Permissions: 440 (r--r-----)
  • ✅ Syntax validated: Using visudo -c
  • ✅ Password-less sudo: Enabled for siva

The user siva now has password-less sudo access on all App servers in the Stratos Datacenter.

Top comments (0)