DEV Community

Cover image for Access Unlocked: The Sudo Way
Olatunde salami
Olatunde salami

Posted on

Access Unlocked: The Sudo Way

#linux #devops #cloudcomputing #redhat

Table Of Content

Introduction

One of the core principles of Linux is the separation of standard users and administrative (root) privileges. Today, I explored how to configure sudo access, which allows users to execute commands with elevated privileges safely and securely.

What is sudo?

s​udo (short for “superuser do”) is a command line utility that allows a permitted user to execute a command as the superuser or another user, as defined by the security policy.

Rather than logging in as root (which can be dangerous), users can gain temporary administrative access using sudo.

Why Use sudo?

  • Security: Limits access to sensitive commands.

  • Auditability: Logs all commands run with sudo for accountability.

  • Convenience: Avoids full root logins, reducing the risk of system wide mistakes.

How to Configure sudo Access

  • Add a User to the sudo Group Most Linux distros (like Ubuntu and Debian) use the sudo group to grant sudo privileges. 
sudo usermod -aG sudo <username>
Enter fullscreen mode Exit fullscreen mode

Replace with the actual user’s name.

For example, to grant sofia sudo access:

sudo usermod -aG sudo Sofia
Enter fullscreen mode Exit fullscreen mode

To apply the group changes:

su - Sofia
Enter fullscreen mode Exit fullscreen mode

Or have the user log out and back in.

  • Verify Access Switch to the user and test: 
sudo whoami
Enter fullscreen mode Exit fullscreen mode

Expected output:

root
Enter fullscreen mode Exit fullscreen mode
  • Edit the sudoers File (Safely!) To customize permissions or define more specific rules, use: 
sudo visudo
Enter fullscreen mode Exit fullscreen mode

This command opens the /etc/sudoers file in a safe editor that prevents syntax errors.

Example Rule:

Allow a user to run only specific commands:

sofia ALL=(ALL) NOPASSWD: /usr/sbin/service apache2 restart
Enter fullscreen mode Exit fullscreen mode

This allows sofia to restart Apache without a password.

  • Creating a Sudoers File in /etc/sudoers.d/ For better management, you can create custom sudoers files: 
sudo visudo -f /etc/sudoers.d/sofia
Enter fullscreen mode Exit fullscreen mode

Inside the file:

sofia ALL=(ALL) ALL
Enter fullscreen mode Exit fullscreen mode

This method is preferred for organizing permissions per user or group.

Best Practices

  1. Avoid using the root account directly.

  2. Limit sudo access to trusted users only.

  3. Log all sudo usage (by default, it’s stored in /var/log/auth.log).

  4. Use visudo instead of editing /etc/sudoers directly.

Why Is sudo an Important Command?

s​udo is one of the most essential tools in Linux system administration. Here’s why:

  • Security Through Least Privilege:
    By default, users operate with limited permissions. sudo ensures that only trusted users can perform sensitive tasks like installing software, modifying system files, or managing services.

  • Reduces Risk of Damage:
    Running as root all the time is dangerous. A single mistyped command can crash the system. sudo limits the time and scope of privileged actions.

  • Accountability and Logging:
    Every sudo action is logged (usually in /var/log/auth.log), allowing administrators to track changes or investigate issues.

  • Granular Control:
    With sudo, you can fine-tune what commands specific users can run ideal in multi user environments.

  • Promotes Best Practices:
    Encourages the principle of “least privilege” by allowing users to elevate privileges only when necessary.

Summary

Today, I learned about the importance of the sudo command in Linux, which allows users to perform administrative tasks securely without logging in as root. I explored how to grant sudo access to users, safely edit the sudoers file, and follow best practices to maintain system security. sudo is a critical tool for privilege management, promoting safety, accountability, and control in multi user environments.

I would love to hear your thoughts, experiences, or tips about Linux!
Feel free to share in the comments and join the conversation.
Connect with me on LinkedIn !

#30DaysLinuxChallenge #CloudWhistler #RedHat #Cloudsecurity #DevOps #Linux #OpenSource #CloudComputing #RedHatEnterpriseLinux #SystemLogs #EnterpriseIT #Observability #Logging #SysAdmin #Automation #CloudEngineer #TechForBusiness #ITSupport #SRE #CloudOps

Top comments (0)