sudoers / PAM — Privilege & Auth

If you like this project, consider supporting me on Buy Me a Coffee ☕️

tags:

• security
• sudo
• pam
• access-control
• sysadmin

• linux

  🔐 sudoers / PAM Cheatsheet

Description

sudo grants controlled privilege escalation; the sudoers file defines who may run which commands as which users. PAM (Pluggable Authentication Modules) is the authentication stack used by sudo, SSH, login, and systemd sessions. / sudo — контролируемое повышение привилегий; sudoers — кто и что может запускать. PAM — стек аутентификации для sudo, SSH, login.

Common use cases / Типовые сценарии:

• Delegating admin without full root / Делегирование админских прав без root
• Time-limited / command-specific access / Доступ с ограничением по времени и командам
• Central policy via LDAP sudoers / Централизация политик через LDAP
• PAM hardening for SSH and local logins / Ужесточение аутентификации через PAM

Status: sudo + sudoers is the default privilege mechanism on mainstream Linux (not legacy). Alternatives: doas (OpenBSD-style, lighter), pkexec/PolicyKit (desktop polkit), RBAC (Solaris/illumos style). / Статус: стандарт для Linux; альтернативы — doas, polkit, RBAC.

Paths: /etc/sudoers, /etc/sudoers.d/*, /etc/pam.d/sudo, /etc/pam.d/sshd, logs /var/log/auth.log or /var/log/secure.

Cross-reference: Polkit, SSH keys, systemctl.

Installation

Packages / Пакеты

# Debian/Ubuntu (usually preinstalled)
apt install sudo

# RHEL/Rocky/Alma
dnf install sudo

# doas alternative (if policy chooses it)
apt install doas

sudo --version
visudo --version

Configuration

Main files / Основные файлы

/etc/sudoers (read-only policy; edit via visudo)

/etc/sudoers.d/ (include directory)

/etc/sudo.conf (plugin loading)

/etc/pam.d/sudo (PAM stack for sudo)

/etc/pam.d/sshd (PAM stack for SSH)

/etc/pam.d/common-auth (Debian family shared auth)

# Edit policy SAFELY (syntax check + backup)
visudo -f /etc/sudoers
visudo -f /etc/sudoers.d/90-sysadmin

[!CAUTION] A syntax error in sudoers can lock out privilege escalation. Always use visudo (it validates and refuses to save a broken file). Keep an open root session while testing. / Ошибка в sudoers может лишить доступа. Всегда правьте через visudo; держите открытую root-сессию.

sudoers basics / Основы sudoers

# Format: who where = (as_whom) what
# File: /etc/sudoers.d/10-admins

# /etc/sudoers.d/10-admins
Defaults        env_reset
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

User_Alias      ADMINS = alice, bob, %sysadmins
Runas_Alias     DB = postgres, mysql
Cmnd_Alias      SERVICE = /usr/bin/systemctl restart *, /usr/bin/systemctl reload *
Cmnd_Alias      DOCKER = /usr/bin/docker
Cmnd_Alias      PKG = /usr/bin/apt, /usr/bin/apt-get, /usr/bin/dnf

ADMINS          ALL = (ALL:ALL) ALL
%sysadmins      ALL = (DB) NOPASSWD: SERVICE
alice           ALL = (root) NOPASSWD: DOCKER
bob             ALL = ALL:SERVICE

Common Defaults / Частые Defaults

# /etc/sudoers.d/00-defaults
Defaults        timestamp_timeout=15
Defaults        env_reset
Defaults        mail_badpass
Defaults        logfile="/var/log/sudo.log"
Defaults        lecture=never
# Defaults      requiretty          # only if policy demands terminal

Passwordless patterns / Паттерны без пароля

# Restricted: only specific service commands
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp.service

# Group-based
%ops ALL=(root) NOPASSWD: /usr/bin/journalctl -u *

# sudoedit for config-only access
%editors ALL=(root) sudoedit /etc/nginx/nginx.conf, /etc/nginx/conf.d/*.conf

[!WARNING] Avoid ALL=(ALL) NOPASSWD: ALL for regular users. Prefer command aliases + group grants. / Избегайте ALL=(ALL) NOPASSWD: ALL для обычных пользователей.

PAM — basic hardening / Базовое ужесточение PAM

/etc/pam.d/sshd

# Debian family (common-auth chain)
auth       required     pam_unix.so
auth       optional     pam_faillock.so preauth
auth       [success=1 default=ignore] pam_succeed_if.so user ingroup wheel
auth       required     pam_deny.so
account    required     pam_unix.so
account    required     pam_faillock.so
account    required     pam_succeed_if.so user ingroup wheel
account    required     pam_unix.so
session    required     pam_limits.so

/etc/security/faillock.conf

deny = 5
unlock_time = 900
even_deny_root
root_unlock_time = 900

# Optional: faillock CLI
faillock --user <USER>
faillock --user <USER> --reset

sudo + PAM interaction / Взаимодействие sudo и PAM

# pam_unix authenticates the INVOKING user for sudo
# sudo timestamp cache (default 5 min) may skip PAM after first auth
# Force re-auth per command via timestamp_timeout=0

Core Management

Inspect rights / Просмотр прав

sudo -l                 # List own privileges
sudo -l -U <USER>       # List another user (needs rights)
sudo -V | head          # Version + environment policy details
sudo -n true            # Test passwordless non-interactively

Validate policy / Проверка политики

visudo -c               # Syntax check sudoers + includes
visudo -f /etc/sudoers.d/90-sysadmin -c

Sample output:

/etc/sudoers: parsed OK
/etc/sudoers.d: parsed OK

Audit sudo usage / Аудит использования sudo

# journal (systemd systems)
journalctl -t sudo --no-pager -n 50
journalctl -t sudo -f

# traditional logs
grep sudo /var/log/auth.log | tail -50
grep sudo /var/log/secure | tail -50

I/O logging (optional) / Логирование ввода-вывода

# /etc/sudoers.d/20-iolog
Defaults        log_input, log_output
Defaults        iolog_dir=/var/log/sudo-io/%{user}
Defaults        iolog_file=%{seq}

# Replay session
sudo -re <SEQ_ID>

[!NOTE] I/O logs can contain secrets typed into terminals. Protect /var/log/sudo-io (root-only) and rotate/retention carefully. / Логи iolog могут содержать секреты — ограничьте доступ и ротацию.

Sysadmin Operations

Service interaction / Работа с сервисами

sudo systemctl restart nginx   # Check status / Проверить статус
sudo systemctl status sshd
sudo -l -U alice | grep systemctl

Limits / Ограничения

# Resource limits via PAM
cat /etc/security/limits.conf
# /etc/security/limits.d/50-nofile.conf
# nginx soft nofile 65535
# nginx hard nofile 65535

Logrotate / Ротация логов

/etc/logrotate.d/sudo

/var/log/sudo.log {
    monthly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
    create 0600 root adm
}

/etc/logrotate.d/auth

# Debian/Ubuntu typically own /var/log/auth.log via rsyslog/logrotate
# RHEL: /var/log/secure

Security

Hardening checklist / Чек-лист ужесточения

1. Never edit sudoers with a raw editor — only visudo / Правьте только через visudo
2. Grant least privilege commands, not shells / Минимальные команды, не оболочки
3. Prefer groups over per-user snowflakes / Группы вместо индивидуальных правил
4. Disable NOPASSWD where MFA is mandatory / Отключайте NOPASSWD при обязательном MFA
5. Monitor auth.log/secure for sudo anomalies / Мониторинг sudo-событий
6. Restrict sudoedit paths / Ограничьте пути sudoedit
7. Keep secure_path correct to avoid PATH hijack / Не доверяйте PATH пользователя
8. Test with sudo -l after every change / Проверяйте права после каждой правки

Common dangerous patterns / Опасные паттерны

# BAD — full shell escalation for everyone
%wheel ALL=(ALL) ALL   # acceptable only with strong account hygiene

# BAD — wildcard commands
user ALL=(root) /usr/bin/systemctl *   # too broad

# BAD — passwordless root for automation accounts without monitoring
backup ALL=(root) NOPASSWD: ALL

Troubleshooting

sudo -V | grep -i path
journalctl -t sudo --since today --no-pager
sudo -l -U <USER> -vv

Comparison Tables

Escalation tools / Инструменты эскалации

Passwordless vs NOPASSWD vs PAM MFA / Сравнение аутентификации

Production Runbooks

Runbook: Grant deploy access to service group / Выдача deploy-прав группе

1. Create OS group deployers / Создать группу
2. usermod -aG deployers <USER> for each deployer / Добавить пользователей
3. Add sudoers.d rule with command alias only for systemctl restart myapp / Добавить правило с командой
4. visudo -c — must parse OK / Проверить синтаксис
5. sudo -l -U <USER> — verify granted commands / Проверить выданные права
6. Test as deployer: sudo -n systemctl restart myapp / Проверить запуск без пароля
7. Monitor auth log for sudo events / Включить мониторинг событий sudo

Runbook: Emergency lockout recovery / Восстановление после блокировки

1. Do NOT edit sudoers via scp/ansible without validation / Не правьте файл напрямую
2. Use console/IPMI/serial access (physical or hypervisor) / Используйте консоль доступа
3. visudo -c to locate syntax error / Найти синтаксическую ошибку
4. Fix or comment offending line; save via visudo / Исправить и сохранить через visudo
5. Open new root shell; test su - and sudo -l / Проверить root-доступ
6. Re-enable monitoring; document root cause / Задокументировать причину

Documentation Links

• sudoers(5) — https://www.sudo.ws/docs/man/sudoers.man/
• PAM — https://github.com/linux-pam/linux-pam
• faillock — https://github.com/linux-pam/linux-pam (pam_faillock)
• OpenBSD doas — https://github.com/sudo-project/doas
• Polkit — https://www.freedesktop.org/software/polkit/docs/latest/
• Debian sudoers — https://wiki.debian.org/sudo