sudo and root
The root account, su and sudo, the sudoers file edited with visudo, the sudo and wheel groups, the shape of a rule (who, where, as whom, what), least privilege and the trail sudo leaves.
- 28 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
root: what is it?
Show the answer
The administration account with UID 0, to which the kernel does not apply file access checks.
A typo under this account (a misplaced rm -rf) is stopped by nothing. Hence the habit of elevating only on demand, command by command.
In this sudoers excerpt, what can tom do with sudo, assuming he belongs to none of the groups cited?
```text
Defaults env_reset
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL
tom ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx
%ops ALL=(root) /usr/bin/systemctl status *`- Restart nginx as root, no password, nothing else
- Do anything as root, without a password
- Restart nginx as root, but only after typing his password
- Restart and stop any service without typing a password
Show the answer
Restart nginx as root, no password, nothing else
NOPASSWD: removes the password prompt for the listed command only, with its exact arguments. sudo systemctl stop nginx would be refused. It is least privilege applied.
The … account has UID …: it is this number, not its name, that gives it its powers.
Show the answer
The root account has UID 0: it is this number, not its name, that gives it its powers.
Another account created with UID 0 would have the same powers as root, which is a classic backdoor to look for in /etc/passwd.
su: what is it?
Show the answer
The command that opens a shell under another account, after asking for that account's password.
With the dash, su - also loads the target account's environment. Its drawback: every administrator must know root's password.
After a
sudo git pull, Léa can no longer modify her own repository: "Permission denied". What is the cause and the fix?- Git removed the write permission after the pull; a chmod -R 777 on the repo fixes everything
- Files now belong to root; give them back with chown, and stop using sudo for git
- Léa left the sudo group; usermod -aG sudo lea puts her back in it
- The repo is locked until the pull is over; you just have to wait
Show the answer
Files now belong to root; give them back with chown, and stop using sudo for git
sudo runs git as root: the files created or modified belong to it, and Léa, neither owner nor in the group, can no longer write. The right reflex: sudo only for what requires it.