Taming sudo: Tricks for Restricting and Logging Administrative Access

Introduction to sudo restrictions

I’ve seen this go wrong when sudo is misconfigured - it can be a real security nightmare. When working with Linux systems, sudo is an essential tool for granting administrative access to users. However, it’s crucial to restrict and log this access to maintain system security and accountability. In this article, we’ll explore practical tricks for taming sudo and ensuring that administrative privileges are used responsibly.

Configuring sudo

The real trick is to edit the sudo configuration file, typically located at /etc/sudoers, with caution. To do this, use the visudo command, which provides a safe and syntax-checked environment:

sudo visudo

Don’t bother with manual editing of the sudoers file - visudo will save you from potential syntax errors. In the sudoers file, you can specify user permissions using the following format:

username hostname = /path/to/command

For example, to allow the user john to run the apt command on the local machine, add the following line:

john localhost = /usr/bin/apt

This is where people usually get burned - they grant too many permissions and compromise system security.

Restricting commands

In practice, it’s better to restrict the commands that can be run with sudo. You can specify a list of allowed commands in the sudoers file. For instance, to allow only the apt and git commands, use the following syntax:

username hostname = /usr/bin/apt, /usr/bin/git

I usually start with a restrictive approach and then gradually add more permissions as needed. You can also use the ALL keyword to allow all commands, but this is not recommended as it grants unrestricted access:

username hostname = ALL

This should be avoided whenever possible.

Logging sudo activity

Logging sudo activity is essential for maintaining system security and accountability. To log sudo activity, you can configure the sudo logging facility to write logs to a specific file or syslog. Add the following line to the sudoers file:

Defaults logfile = /var/log/sudo.log

This will log all sudo activity to the /var/log/sudo.log file. You can also use the syslog facility to log sudo activity to the system log:

Defaults syslog = yes

For more information on sudo configuration and logging, refer to the official sudo documentation.

Best practices

When working with sudo, it’s essential to follow best practices to ensure system security and accountability:

• Use the visudo command to edit the sudoers file.
• Specify user permissions and restrict commands whenever possible.
• Log sudo activity to a secure location.
• Regularly review sudo logs to detect potential security issues.

See also

• Using jq to Parse and Analyze Linux Log Files in Real Time
• Taming Noisy systemd Logs with Journalctl Filters and Log Level Adjustments
• Taming Shared Directory Chaos with Setgid and Sticky Bits
• Taming Log Noise with jq: Extracting Insights from JSON Logs in Linux
• Rescuing a Linux System with a Broken Initramfs: When Updates Go Wrong