Borrowing admin rights with sudo
You learn how to let someone do one admin job without sharing the root password: how sudo runs a command as another identity, the rule book (/etc/sudoers and /etc/sudoers.d), who is allowed to do what (sudo -l), writing a narrow rule and checking it with visudo, and reading sudo’s log; at the end you find the account that opened a root shell and the dangerous rule that allowed it, and remove it yourself.
Level 101 · 50 min
Mert from the support team wants to read the order audit log to look into a customer complaint. The log is open to root only. The easy but wrong fix: give Mert the root password. Then Mert can do everything, the logs only ever show "root", and when Mert leaves the password has to be changed for everybody.
The right fix is called sudo: the way to say "this person may run this one command with admin rights". Analogy: you don’t copy and hand out the building’s master key (the root password); you give the clerk a visitor card that opens only the archive room, and every use of the card is written in a register. The rights are lent, limited, and leave a trail.
In this lesson you meet the terms one by one: sudo (the program that runs a command with another user’s identity), sudoers (the rule file that says who may run what), visudo (the tool that checks the rule file) and the principle of least privilege (giving everyone only as much power as their job needs).
In the first three steps the commands are ready ("Type in terminal"); in the middle steps you see the command and type it by hand; the last two steps give only the goal. Account names, log entries and the faulty rule differ in every lab.
What you will do in this lesson
- The problem: Mert can’t read the log
- sudo: run one command as another identity
- The rule book: /etc/sudoers
- Who may do what? sudo -l
- Write a narrow rule and check it
- Verify the rule; see the lab’s limit
- Check drafts before installing them
- sudo leaves a trail: the log file
- Who opened a root shell in the log?
- Find and remove the dangerous rule
- Short quiz
Skills you will earn
- Testing a setting as another user (su -c)
- Reading a permission string (rwxr-x---)
- Running a command as another identity with sudo (sudo, sudo -u)
- Reading the rule book: /etc/sudoers and /etc/sudoers.d
- Seeing who may run what with sudo -l
- Writing a narrow, least-privilege sudo rule
- Checking sudo rules with visudo -c
- Reading the sudo log: who ran what as whom
- Filtering and counting lines (grep, grep -c)
- Writing a short, precise finding
- Finding and removing dangerous sudo rules (NOPASSWD: ALL)
- Keeping evidence with its time and permissions (cp -p)
← Account management: useradd, passwd, usermod and userdel · Linux quick start · Final task: prepare a secure account and folder for a new hire →
Start for free