What do the lines for root, sudo and wheel in sudoers mean?
Clash Royale CLAN TAG#URR8PPP
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo configuration
edited Feb 18 at 11:28
Kusalananda
135k17255422
asked Feb 17 at 22:00
J. DoeJ. Doe
1
add a comment |
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo configuration
edited Feb 18 at 11:28
Kusalananda
135k17255422
asked Feb 17 at 22:00
J. DoeJ. Doe
1
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
Feb 17 at 23:04
add a comment |
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo configuration
edited Feb 18 at 11:28
Kusalananda
135k17255422
asked Feb 17 at 22:00
J. DoeJ. Doe
1
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo configuration
sudo configuration
edited Feb 18 at 11:28
Kusalananda
135k17255422
asked Feb 17 at 22:00
J. DoeJ. Doe
1
edited Feb 18 at 11:28
Kusalananda
135k17255422
asked Feb 17 at 22:00
J. DoeJ. Doe
1
edited Feb 18 at 11:28
Kusalananda
135k17255422
edited Feb 18 at 11:28
Kusalananda
135k17255422
edited Feb 18 at 11:28
Kusalananda
135k17255422
135k17255422
asked Feb 17 at 22:00
J. DoeJ. Doe
1
asked Feb 17 at 22:00
J. DoeJ. Doe
1
asked Feb 17 at 22:00
J. DoeJ. Doe
1
1
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
Feb 17 at 23:04
add a comment |
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
Feb 17 at 23:04
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
Feb 17 at 23:04
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
Feb 17 at 23:04
add a comment |
1 Answer
1
active
oldest
votes
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
Feb 17 at 22:55
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
Feb 17 at 23:02
|
show 9 more comments
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501247%2fwhat-do-the-lines-for-root-sudo-and-wheel-in-sudoers-mean%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
Feb 17 at 22:55
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
Feb 17 at 23:02
|
show 9 more comments
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
Feb 17 at 22:55
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
Feb 17 at 23:02
|
show 9 more comments
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
edited Feb 17 at 22:40
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
answered Feb 17 at 22:27
KusalanandaKusalananda
135k17255422
135k17255422
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
Feb 17 at 22:55
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
Feb 17 at 23:02
|
show 9 more comments
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
Feb 17 at 22:55
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
Feb 17 at 23:02
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
Feb 17 at 22:46
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
Feb 17 at 22:50
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing the
sudoers file. Making mistakes in that file could have serious or at least very inconvenient consequences.– Kusalananda
Feb 17 at 22:55
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing the
sudoers file. Making mistakes in that file could have serious or at least very inconvenient consequences.– Kusalananda
Feb 17 at 22:55
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
Feb 17 at 22:57
@J.Doe I believe I covered those points in my answer.
sudo would still deny root from using sudo if you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of the sudo program). The other difference that you ask about is a difference in how you administrate sudo privileges. I mentioned this too. You either add users individually to the sudoers file, but this may be to bothersome on large systems, so it may be easier to add users to a special sudo group.– Kusalananda
Feb 17 at 23:02
@J.Doe I believe I covered those points in my answer.
sudo would still deny root from using sudo if you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of the sudo program). The other difference that you ask about is a difference in how you administrate sudo privileges. I mentioned this too. You either add users individually to the sudoers file, but this may be to bothersome on large systems, so it may be easier to add users to a special sudo group.– Kusalananda
Feb 17 at 23:02
|
show 9 more comments
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501247%2fwhat-do-the-lines-for-root-sudo-and-wheel-in-sudoers-mean%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
Feb 17 at 23:04