Making a custom sudoers file

For a sysadmin, allowing access to sudo is nerve-wracking, particularly if you work in an environment where you seem to be the only one concerned about security, where passwordless accounts are abundant and all users are made administrators for ease of access. This is most common in OS X clusters, as Linux does not permit empty passwords by default. A properly configured sudoers file is very important.

This assumes you have already sorted your users into appropriate groups, such as removing guests from the 'wheel' group.

Defining command and user aliases
The first section to edit will be # Cmnd alias specification. You can define groups of commands such as:

Cmnd_Alias      SYS_COMMANDS      = /sbin/unmount, /sbin/mount

Cmnd_Alias      SERVICES          = /bin/ls, /bin/cat, /sbin/halt, /sbin/reboot,
                                 /sbin/shutdown

Cmnd_Alias      ADMIN_TOOLS       = /usr/bin/passwd, /bin/chmod, /bin/chown, /bin/chgrp

Cmnd_Alias      EDITING           = /usr/bin/vi

Cmnd_Alias      STORAGE           = /sbin/fdisk, /sbin/sfdisk, /sbin/parted,
                                /sbin/partprobe

You can also append options to the commands; for example, creating an alias for /usr/bin/su - Guest, meaning that it is permissible to use sudo su - Guest, but not sudo su - some-other-user.

User aliases operate using the same syntax:

User_Alias      GUESTS  = guest, user, bob
User_Alias      ADMINS  = joe, alice

Limiting and denying commands to users and groups
Next, edit the # User privilege specification section. A % denotes a group, while a string without indicates a user:

# root and 'wheel' group users can run all commands as long as they authenticate
with their passwords
root            ALL       = (ALL) ALL
%wheel          ALL       = (ALL) ALL

# only bob can use storage tools
bob             ALL       = STORAGE

# ADMINS can use chmod, chown, chgrp and passwd, but they can't change root's password
%ADMINS         ALL       = ADMIN_TOOLS !/usr/bin/passwd root

# 'admin' group users can use all commands in the EDITING alias with a password, and
all commands in SYS_COMMANDS and SERVICES without authenticating; but can't use any
other commands
%admin          ALL       = EDITING, NOPASSWD:SYS_COMMANDS,SERVICES

# Guest users, who don't have passwords, can only mount and unmount drives
%guest          ALL       = NOPASSWD:SYS_COMMANDS

# joe can authenticate to use any command in /bin except for chmod, chown, chgrp,
chown and vi, but he can use /bin/find without authenticating (there is no real
usefulness to NOPASSWD in this case)
joe             ALL       = /bin, NOPASSWD:/bin/find, !/bin/chmod, !/bin/chgrp,
                          !/bin/chown, !EDITING

# alice can su to any user except for root, but without flags (su - user is not allowed)
alice           ALL       = /usr/bin/su [!-]*, !/usr/bin/su *root*

# everybody needs to be able to kill a program when it hangs without authenticating
ALL             ALL       = NOPASSWD:/bin/kill

Defining default settings
A few useful Defaults specifications:

# only allow one failed password attempt
Defaults        passwd_tries += "1"

# the message when a user types an incorrect password
Defaults        badpass_message += "And just what do you think you're doing, Dave?"

# this prevents sudo from being used in a script; the user must be logged in
Defaults    requiretty

Read Full Post

Enabling the root account in Mac OS X

By default the root account is disabled under Mac OS X, replaced by the first user created during the installation, who although is granted some administrator priviledges, can accomplish very little other than application installation and basic access management. To use many of the UNIX tools or do much with the Terminal, the root account must be enabled.

To enable it, use sudo su while logged in as an administrative user, and if you have not enabled NOPASSWD sudo commands, you will be prompted for your password. Now use passwd
to change the root password; it does not have to be the same as the administrator password.

Once the account is enabled, it will show up as "Other" in the login window.

Read Full Post