{"id":3344,"date":"2016-07-06T01:02:54","date_gmt":"2016-07-06T00:02:54","guid":{"rendered":"https:\/\/stevepedwards.today\/DebianAdmin\/?p=3344"},"modified":"2016-07-06T01:02:54","modified_gmt":"2016-07-06T00:02:54","slug":"setting-sudo-users-with-adduser-and-visudo-in-mint-and-raspbian","status":"publish","type":"post","link":"https:\/\/stevepedwards.today\/DebianAdmin\/setting-sudo-users-with-adduser-and-visudo-in-mint-and-raspbian\/","title":{"rendered":"Setting Sudo Users with Adduser and Visudo in Mint and Raspbian"},"content":{"rendered":"
<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n

sudo <\/span>is a command that allows users with appropriate permissions to take on another users or superuser (root) ID, so their permissions.<\/p>\n

man sudo<\/span><\/p>\n

DESCRIPTION<\/span><\/p>\n

sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.<\/span><\/p>\n

man su<\/span><\/p>\n

NAME<\/span><\/p>\n

su - change user ID or become superuser<\/span><\/p>\n

man visudo<\/span><\/p>\n

NAME<\/span><\/p>\n

visudo \u201d edit the sudoers file<\/span><\/p>\n

man adduser<\/span><\/p>\n

NAME<\/span><\/p>\n

adduser, addgroup - add a user or group to the system<\/span><\/p>\n

At install, Mint sets up the installer's name account as a sudoer in the sudo group automatically, as does Raspian\u00a0which\u00a0uses a default account name of pi, as seen in each OS's \/etc\/group file:<\/p>\n

cat \/etc\/group | grep\u00a0sudo<\/span><\/p>\n

sudo:x:27:stevee<\/span><\/p>\n

cat \/etc\/group | grep sudo<\/span><\/p>\n

sudo:x:27:pi<\/span><\/p>\n

You can see these different user's group names, starting at 1000, also (a user has a default group of the same name unless you specify different at creation with useradd <\/span>name <\/span>--ingroup xxx<\/span>) by looking at the \/etc\/group file for each OS, grepping for user accounts of 1000 and above. First Mint:<\/p>\n

stevee@AMD ~ $ cat \/etc\/group | grep 100.:<\/span><\/p>\n

stevee:x:1000:<\/b><\/span><\/p>\n

then Raspian:<\/p>\n

stevee@piblanc ~ $ cat \/etc\/group | grep 100.:<\/span><\/p>\n

pi:x:1000:<\/b><\/span><\/p>\n

indiecity:x:1001:root<\/span><\/p>\n

stevee:x:1002:<\/span><\/p>\n

For any linux OS, user\/group root is always created first and has group number 0:<\/span><\/p>\n

cat \/etc\/group | grep root<\/span><\/p>\n

root:x:0:<\/span><\/p>\n

Above, user pi is the first user account created by default at install in group 1000, but stevee was an name option during install for Mint, and that first user is added to the groups visible. Click group box for full view and see group stevee not included! <\/span>Below for Mint:<\/span><\/p>\n

<\/p>\n

Similar blanket coverage memberships are given to user pi also:<\/p>\n

cat \/etc\/group | grep pi<\/span><\/p>\n

adm:x:4:pi<\/span><\/p>\n

dialout:x:20:pi<\/span><\/p>\n

cdrom:x:24:pi<\/span><\/p>\n

sudo:x:27:pi<\/b>,stevee,joe,fred<\/span><\/p>\n

audio:x:29:pi<\/span><\/p>\n

video:x:44:pi,stevee,motion<\/span><\/p>\n

plugdev:x:46:pi<\/span><\/p>\n

games:x:60:pi<\/span><\/p>\n

users:x:100:pi<\/span><\/p>\n

pi:x:1000:<\/span><\/p>\n

netdev:x:106:pi<\/span><\/p>\n

input:x:999:pi<\/span><\/p>\n

spi:x:998:pi<\/span><\/p>\n

i2c:x:997:pi<\/span><\/p>\n

gpio:x:996:pi<\/span><\/p>\n

or for Raspbian and Mint resp.<\/p>\n

id pi<\/span>
\nuid=1000(pi) gid=1000(pi) groups=1000(pi),4(adm),20(dialout),24(cdrom),27(sudo),29(audio),44(video),<\/span><\/p>\n

46(plugdev),60(games),100(users),106(netdev),999(input),998(spi),997(i2c),996(gpio)<\/span><\/p>\n

id stevee<\/span>
\nuid=1000(stevee) gid=1000(stevee) groups=1000(stevee),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),110(sambashare)<\/span><\/p>\n

Both of these users have to have initial root powers via sudo to set anything up at the start including setting a new password for the root account itself don't forget to do it!!<\/span><\/p>\n

sudo passwd root<\/span><\/p>\n

For a user to be a sudoer the account has to be listed, or in an appropriate group, in the \/etc\/sudoers.tmp file accessible via:<\/span><\/p>\n

sudo visudo<\/span><\/p>\n

passwd...<\/span><\/p>\n

There are subtle differences between the two OS's files at first:<\/span><\/p>\n

<\/p>\n

For both systems, root is all powerful of course:<\/span><\/p>\n

# User privilege specification<\/span><\/p>\n

root ALL=(ALL:ALL) ALL<\/span><\/p>\n

For Mint, a legacy\u00a0%<\/i>admin<\/i> line exists but the group name admin does not - replaced by sudo since Ubuntu 12.04. <\/strong><\/em><\/span><\/p>\n

There is an \"adm\" group allowing members to view log files. You can get an idea of group function by finding what type of files each groups owns e.g.:<\/span><\/p>\n

sudo find \/ -group adm<\/span><\/p>\n

\/var\/log\/mysql\/error.log.3.gz<\/span><\/strong>
\n\/var\/log\/mysql\/error.log.5.gz<\/span><\/strong>
\n\/var\/log\/mysql\/error.log.2.gz<\/span><\/strong>
\nfind: \u02dc\/run\/user\/1000\/gvfs,: Permission denied<\/span><\/p>\n

There is a sudo group instead of admin for both later Mint and Raspbian versions:<\/span><\/p>\n

# Members of the admin<\/b> group may gain root privileges<\/b><\/span><\/p>\n

%admin <\/b>ALL=(ALL) ALL<\/span><\/p>\n

# Allow members of group sudo to execute any command<\/b><\/span><\/p>\n

%sudo<\/b> ALL=(ALL:ALL) ALL<\/span><\/p>\n

For Raspbian:<\/span><\/p>\n

# Allow members of group sudo to execute any command<\/span><\/p>\n

%sudo<\/b> ALL=(ALL:ALL) ALL<\/span><\/p>\n

#includedir \/etc\/sudoers.d<\/span><\/p>\n

pi <\/b>ALL=(ALL) NOPASSWD<\/b>: ALL<\/span><\/p>\n

You see both OS's visudo files achieve the same result - the first user accounts can gain root powers but by different means. <\/span><\/p>\n

Mint automatically adds the installer to the sudo group requiring a password to achieve su; <\/span><\/p>\n

Raspbian allows default user pi su powers via sudo group membership, but without needing a password due to the visudo file NOPASSWD <\/b><\/span>addition.<\/b> <\/span><\/p>\n

This may have been decided by the Raspbian team to give Pi users instant update and admin ability whilst learning, not being stumped by passwords or how to change them.<\/span><\/p>\n

So, no auth is required for user pi when he, for example does:<\/span><\/p>\n

sudo apt-get update<\/span><\/p>\n

Removing the NO <\/span>from NO<\/span>PASSWD <\/span>text may be the first thing you want to change if you are in an insecure environment...If you do, now when pi tries an upgrade:<\/span><\/p>\n

sudo apt-get upgrade <\/span><\/p>\n

We trust you have received the usual lecture from the local System<\/span><\/p>\n

Administrator. It usually boils down to these three things:<\/span><\/p>\n

#1) Respect the privacy of others.<\/span><\/p>\n

#2) Think before you type.<\/span><\/p>\n

#3) With great power comes great responsibility.<\/span><\/p>\n

[sudo] password for pi:<\/span><\/p>\n

To view a user's permissions set in \/etc\/sudoers e.g:<\/p>\n

sudo -l -U pi<\/span><\/p>\n

[sudo] password for stevee:<\/span>
\nMatching Defaults entries for pi on this host:<\/span>
\n env_reset, mail_badpass,<\/span>
\n secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin<\/span><\/p>\n

User pi may run the following commands on this host:<\/span>
\n (ALL : ALL) ALL<\/span>
\n (ALL) PASSWD: ALL<\/span><\/p>\n

So, if you wish to allow new users sudo powers, you have different options available to you, for both systems. <\/span><\/p>\n

For example, you could add a user to the sudo group in Mint, as your installer did, but that grants equivalent powers as you, (which you probably won't want in reality, system requirements depending...):<\/span><\/p>\n

sudo adduser joe --ingroup sudo<\/span><\/p>\n

Adding user `joe' ...<\/span><\/p>\n

Or, if user joe already exists, add to existing group sudo by:<\/span><\/p>\n

sudo adduser joe sudo<\/span><\/p>\n

Adding user `joe' to group `sudo' ...<\/span><\/p>\n

Adding user joe to group sudo<\/span><\/p>\n

Done.<\/span><\/p>\n

NOTICE here though, that adding user joe to the sudo group, he does not have to use passwd auth to check with Apt\u00a0for mint updates, as was an\u00a0option for all users at install, but WILL need to auth to install them.<\/p>\n

sudo -l -U joe<\/span>
\nMatching Defaults entries for joe on dellmint:<\/span>
\n env_reset, mail_badpass,<\/span>
\n secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin<\/span><\/p>\n

User joe may run the following commands on dellmint:<\/span>
\n (ALL : ALL) ALL<\/span>
\n (root) NOPASSWD<\/strong>: \/usr\/lib\/linuxmint\/mintUpdate\/checkAPT.py<\/span><\/p>\n

Or if the account exists already add the name to the visudo file, as user pi is. <\/span><\/p>\n

#includedir \/etc\/sudoers.d<\/span><\/p>\n

pi ALL=(ALL) PASSWD: ALL<\/span><\/p>\n

If a user is not in the sudoer's file, and attempts sudo, a warning is issued:<\/span><\/p>\n

[sudo] password for fred: <\/span><\/p>\n

fred is not in the sudoers file. This incident will be reported.<\/span><\/p>\n

Just adding his name is enough to allow him su with password auth:<\/span><\/p>\n

fred ALL=(ALL) PASSWD: ALL<\/span><\/p>\n

Notice that he is not added to the sudo group just by this visudo file entry! Now though, he can just add himself:<\/span><\/p>\n

cat \/etc\/group | grep sudo<\/span><\/p>\n

sudo:x:27:pi,stevee,joe<\/span><\/p>\n

cat \/etc\/group | grep fred<\/span><\/p>\n

fred:x:1004:<\/span><\/p>\n

sudo adduser fred sudo<\/span><\/p>\n

Adding user `fred' to group `sudo' ...<\/span><\/p>\n

Adding user fred to group sudo<\/span><\/p>\n

Done.<\/span><\/p>\n

cat \/etc\/group | grep sudo<\/span><\/p>\n

sudo:x:27:pi,stevee,joe,fred<\/b><\/span><\/p>\n

The files that visudo edits are, from the man page:<\/p>\n

FILES<\/span>
\n \/etc\/sudoers List of who can run what<\/span><\/p>\n

\/etc\/sudoers.tmp Lock file for visudo<\/span><\/p>\n

sudo vi \/etc\/sudoers.d\/README<\/span><\/p>\n

# Finally, please note that using the visudo command is the recommended way<\/span>
\n# to update sudoers content, since it protects against many failure modes.<\/span>
\n# See the man page for visudo for more information.<\/span><\/p>\n

For people familiar with Access Control Lists, you can see by reading man sudoers<\/span> that \/etc\/sudoers is just that, as you can restrict individual users\/groups to specific function only, or leave wide open as are the default sudo members.<\/span><\/p>\n

Re the GUI above, and a user not showing in his own group list, it means\u00a0that if you add a user using adduser\u00a0name --ingroup xxx<\/span>\u00a0to another group (so is NOT the user's name) it won't be apparent what his group is in this GUI or grepped from \/etc\/group; only from the \/etc\/passwd file.<\/strong><\/em><\/p>\n

sudo adduser bill --ingroup audio<\/span>
\nAdding user `bill' ...<\/span>
\nAdding new user `bill' (1001) with group `audio' ...<\/span><\/p>\n

cat \/etc\/group | grep 100.:<\/span>
\nstevee:x:1000:stevee<\/span><\/p>\n

cat \/etc\/passwd | grep 100.:<\/span>
\nstevee:x:1000:1000:stevee,,,:\/home\/stevee:\/bin\/bash<\/span>
\nbill:x:1001:29:,,,:\/home\/bill:\/bin\/bash<\/span><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n

sudo is a command that allows users with appropriate permissions to take on another users or superuser (root) ID, so their permissions. man sudo DESCRIPTION sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. man su NAME su - change user ID or ...\u00a0 Setting Sudo Users with Adduser and Visudo in Mint and Raspbian<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-3344","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"a3_pvc":{"activated":true,"total_views":1,"today_views":0},"_links":{"self":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/3344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/comments?post=3344"}],"version-history":[{"count":0,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/3344\/revisions"}],"wp:attachment":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/media?parent=3344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/categories?post=3344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/tags?post=3344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}