Delegate Administrative Roles
Let others do your work for you without giving away root privileges.
The sudo
utility can help you delegate some
system responsibilities to other people, without giving away full
root access. It is a setuid root binary
that executes commands on an authorized user’s
behalf, after she has entered her current password.
As root, run /usr/sbin/visudo to edit the list
of users who can call sudo. The default
sudo list looks something like this:
root ALL=(ALL) ALL
Unfortunately, many system administrators tend to use this entry as a template and grant unrestricted root access to all other admins unilaterally:
root ALL=(ALL) ALL rob ALL=(ALL) ALL jim ALL=(ALL) ALL david ALL=(ALL) ALL
While this may allow you to give out root access without giving away
the root password, this method is truly useful only when all of the
sudo users can be completely trusted. When
properly configured, the sudo utility provides
tremendous flexibility for granting access to any number of commands,
run as any arbitrary uid.
The syntax of the sudo line is:
user machine=(effective user)command
The first column specifies the sudo user. The
next column defines the hosts in which this sudo
entry is valid. This allows you to easily use a single
sudo configuration across multiple machines.
For example, suppose you have a developer who needs root access on a development machine, but not on any other server:
peter beta.oreillynet.com=(ALL) ALL
The next column (in parentheses) specifies the effective ...