MAN page from Old RedHat 5.X sudo-1.5.4-4.i386.rpm

sudoers

Section: FILE FORMATS (5)
Updated: 1.5.4
Index 

NAME

sudoers - list of which users may execute what as root 

DESCRIPTION

The sudoers file is composed of an optional host alias section,an optional command alias section and the user specification section.All command or host aliases need to start with their respective keywords(ie: Host_Alias, User_Alias, Runas_Alias or Cmnd_Alias).If there are multiple occurrences of a user, the union of the entrieswill be used. 

user specification format:

  user access_group [: access_group] ...

    access_group ::= host_type = [(runas_list)] [NOPASSWD:] [op]cmnd_type                     [,[(user_list)] [NOPASSWD:] [op]cmnd_type] ...        host_type ::= a lower-case hostname, netgroup, ip address,                     network number, network number/netmask,                     or host alias.       runas_list ::= comma-separated list of users, groups,                      netgroups or Runas_Aliases the user may run                      commands as (default is root).       cmnd_type ::= a command OR a command alias.              op ::= the logical "!" NOT operator.

 

host alias section format:

  Host_Alias HOSTALIAS = host-list

      Host_Alias ::= a keyword.       HOSTALIAS ::= an upper-case alias name.       host-list ::= a comma separated list of hosts, netgroups,                     ip addresses, networks.

 

user alias section format:

  User_Alias USERALIAS = user-list

      User_Alias ::= a keyword.       USERALIAS ::= an upper-case alias name.       user-list ::= a comma separated list of users, groups, netgroups.

 

runas alias section format:

  Runas_Alias RUNASALIAS = runas-list

      Runas_Alias ::= a keyword.       RUNASALIAS ::= an upper-case alias name.       runas-list ::= a comma separated list of users, groups, netgroups.

 

command alias section format:

  Cmnd_Alias CMNDALIAS = cmnd-list

      Cmnd_Alias ::= a keyword.       CMNDALIAS ::= an upper-case alias name.       cmnd-list ::= a comma separated list commands.

 

command specification:

  path arg1 arg2 .. argn = command

            path ::= a fully qualified pathname.       arg[1..n] ::= optional command line arguments.

 

wildcards (aka meta characters):

sudo allows shell-style wildcards along with command argumentsin the sudoers file. Wildcard matching is done via the POSIXfnmatch(3) routine.

*

Matches any set of zero or more characters.

?

Matches any single character.

[...]

Matches any character in the specified range.

[!...]

Matches any character not in the specified range.

\x

For any character ``x'', evaluates to ``x''. This is used toescape special characters such as: ``*'', ``?'', ``['', and ``}''.

 

exceptions to wildcard rules:

The following exceptions apply to the above rules:

If the empty string "" is the only command line argument in thesudoers entry it means that command may take no arguments.

 

other special characters and reserved words:

Text after a pound sign (#) is considered a comment.Words that begin with a percent sign (%) are assumed tobe UN*X groups (%staff refers to users in the group staff).Words that begin with a plus sign (+) are assumed tobe netgroups (+cshosts refers to the netgroup cshosts).Long lines can be newline escaped with the backslash \ character.The reserved word NOPASSWD indicates that a user need notenter a password for the command listed in that entry.

The reserved alias ALL can be used for both {Host,User,Cmnd}_Alias.DO NOT define an alias of ALL, it will NOT be used.Note that ALL implies the entire universe of hosts/users/commands.You can subtract elements from the universe by using the syntax:
   user  host=ALL,!ALIAS1,!/etc/halt...Note that the ``!'' notation only works in a user's command list. Youmay not use it to subtract elements in a User_Alias, Host_Alias,Cmnd_Alias or user list.

Commands may have optional command line arguments. If they do,then the arguments in the sudoers file must exactly match thoseon the command line. It is also possible to have a command'sarguments span multiple lines as long as the line continuancecharacter ``\'' is used. The following characters must be escapedwith a ``\'' if used in command arguments: ``,'', ``:'', ``='', ``\''. 

EXAMPLES

    # Host alias specification    Host_Alias  HUB=houdini:\                REMOTE=merlin,kodiakthorn,spirit    Host_Alias  SERVERS=houdini,merlin,kodiakthorn,spirit    Host_Alias  CUNETS=128.138.0.0/255.255.0.0    Host_Alias  CSNETS=128.138.243.0,128.138.204.0,\                       128.138.205.192

    # User alias specification    User_Alias  FULLTIME=millert,dowdy,mikef    User_Alias  PARTTIME=juola,mccreary,tor

    # Runas alias specification    Runas_Alias OP=root,operator

    # Command alias specification    Cmnd_Alias  LPCS=/usr/etc/lpc,/usr/ucb/lprm    Cmnd_Alias  SHELLS=/bin/sh,/bin/csh,/bin/tcsh,/bin/ksh    Cmnd_Alias  SU=/bin/su    Cmnd_Alias  MISC=/bin/rm,/bin/cat:\                SHUTDOWN=/etc/halt,/etc/shutdown

    # User specification    FULLTIME    ALL=(ALL) NOPASSWD: ALL    %wheel      ALL=ALL    PARTTIME    ALL=ALL,!SHELLS,!SU    +interns    +openlabs=ALL,!SHELLS,!SU    britt       REMOTE=SHUTDOWN:ALL=LPCS    jimbo       CUNETS=/bin/su ?*,!/bin/su root    nieusma     SERVERS=SHUTDOWN,/etc/reboot:\                HUB=ALL,!SHELLS    jill        houdini=/etc/shutdown -[hr] now,MISC    markm       HUB=ALL,!MISC,!/etc/shutdown,!/etc/halt    davehieb    merlin=(OP) ALL:SERVERS=/etc/halt:\                kodiakthorn=NOPASSWD: ALL    steve       CSNETS=(operator) /usr/op_commands/

 

Host Alias specifications:

The are four host aliases. The first actually containstwo aliases. It sets HUB to be houdini and REMOTEto the three machines merlin, kodiakthorn and spirit.Similarly, SERVERS is set to the machines houdini, merlin,kodiakthorn and spirit. The CSNETS alias will matchany host on the 128.138.243.0, 128.138.204.0, or 128.138.205.192nets. The CUNETS alias will match any host on the 128.138.0.0(class B) network. Note that these are network addresses, not ipaddresses. Unless an explicate netmask is given, the local netmaskis used to determine whether or not the current host belongs to a network. 

User Alias specifications:

The two user aliases simply groups the FULLTIME andPARTTIME folks into two separate aliases. 

Command alias specifications:

Command aliases are lists of commands with or without associatedcommand line arguments. The entries above should be self-explanatory. 

User specifications:

FULLTIME

Full-time sysadmins in the FULLTIME alias may run anycommand on any host as any user without a password.

%wheel

Any user in the UN*X group wheel may run anycommand on any host.

PARTTIME

Part-time sysadmins in the PARTTIME alias may run anycommand except those in the SHELLS and SU aliaseson any host.

+interns

Any user in the netgroup interns may run anycommand except those in the SHELLS and SU aliaseson any host that is in the openlabs netgroup.

britt

The user britt may run commands in the SHUTDOWN aliason the REMOTE machines and commands in the LPCS aliason any machine.

jimbo

The user jimbo may su to any user save root on themachines on CUNETS (which is explicately listed as a classB network).

nieusma

The user nieusma may run commands in the SHUTDOWN aliasas well as /etc/reboot on the SERVER machines andany command except those in the SHELLS alias on the HUBmachines.

jill

The user jill may run /etc/shutdown -h now or/etc/shutdown -r now as well as the commands in theMISC alias on houdini.

markm

The user markm may run any command on the HUB machinesexcept /etc/shutdown, /etc/halt, and commands listedin the MISC alias.

davehieb

The user davehieb may run any command on merlin as anyuser in the Runas_Alias OP (ie: root or operator). He mayalso run /etc/halt on the SERVERS and any commandon kodiakthorn (no password required on kodiakthorn).

steve

The user steve may run any command in the /usr/op_commands/directory as user operator on the machines on CSNETS.

 

CAVEATS

The sudoers file should always be edited by the visudocommand which locks the file and does grammatical checking. It isimperative that the sudoers be free of syntax errors since sudowill not run with a syntactically incorrect sudoers file. 

FILES

 /etc/sudoers           file of authorized users. /etc/netgroup          list of network groups.

 

SEE ALSO

sudo(8), visudo(8), su(1), fnmatch(3).

---

 

Index

NAME

DESCRIPTION

user specification format:

host alias section format:

user alias section format:

runas alias section format:

command alias section format:

command specification:

wildcards (aka meta characters):

exceptions to wildcard rules:

other special characters and reserved words:

EXAMPLES

Host Alias specifications:

User Alias specifications:

Command alias specifications:

User specifications:

CAVEATS

FILES

SEE ALSO

---

This document was created byman2html,using the manual pages.