How to give Sudo access to administrators and special users

/etc/sudoers  (main configuration file)

usernames/group servername = (usernames command can be run as) command


Groups are the same as user groups and are differentiated from regular users by a % at the beginning. The Linux user group “users” would be represented by %users.
You can have multiple usernames per line separated by commas.
Multiple commands also can be separated by commas. Spaces are considered part of the command.
The keyword ALL can mean all usernames, groups, commands and servers.
If you run out of space on a line, you can end it with a back slash (\) and continue on the next line.
sudo assumes that the sudoers file will be used network wide, and therefore offers the option to specify the names of servers which will be using it.
In most cases, the file is used by only one server and the keyword ALL suffices for the server name.
The NOPASSWD keyword provides access without prompting for your password.


Granting All Access to Specific Users 

Grant admin1 and admin2 full access to all privileged commands, with this sudoers entry.


admin1,admin2 ALL=(ALL) ALL


Granting Access To Specific Users To Specific Files 


teamlead1, %Project ALL= /sbin/, /usr/sbin

This entry allows user teamlead1 and all the members of the group Project to gain access to all the program files in the /sbin and /usr/sbin directories

Granting Access to Specific Files as Another User 

sudo -u entry allows allows you to execute a command as if you were another user, but first you have to be granted this privilege in the sudoers file.

This feature can be convenient for programmers who sometimes need to kill processes related to projects they are working on. For example, programmer user1 is on the team developing a financial package that runs a program called thread1 as user accounts. From time to time the application fails, requiring “user1” to stop it with the /bin/kill, /usr/bin/kill or /usr/bin/pkill commands but only as user “accountsmanager”. The sudoers entry would look like this:

user1 ALL=(accountsmanager) /bin/kill, /usr/bin/kill, /usr/bin/pkill

User user1 is allowed to stop the thread1 process with this command:

[user1@learnadmin user1]# sudo -u accountsmanager pkill thread1

SUDO

Sudo (su "do") the name it self indicates that switching user and to do some command as admin.
What actually the difference between su and sudo is that,su is switch user so that we should know administrator password to get admin rights.
But this is security threat for the superuser password it self.
So if an admin wants to give a normal user some/all admin rights depending on his/her requirement's so that he can execute some system level commands and in turn it will not effect root's integrity/properties etc.

So how to give sudo permissions to user?
To use sudo the sudo package should be installed on the server.

step1:quarry for the sudo package

#rpm -q sudo

step2:If the sudo package is not installed install it by below command

#rpm -ivh sudo.versionno.arch.rpm

step3:configuring sudousers

#visudo

there is no space between vi and sudo right? remember this.
when you execute the above command you will be able to open one temporary file which contains all sudo related configuration in it
so you will find some thing like below
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# User privilege specification
root    ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel        ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL
you will find some thing like this in that file
this file is self explanatory
We will see some example
user alias specification you can find it
this is the place where we can put user names to whom I want to give sudo permissions
so this is  my sample file
User_Alias USER=surendra
here I declared surendra to use sudo
Cmnd_Aias CMD=/usr/sbin/useradd
I set CMD to /usr/sbin/useradd so if I combined USER variable and CMD variable
the user surendra can execute useradd command with out having admin rights
so this the way I can combine the USER and CMD
USER ALL=CMD
so USER(surendra) can execute all the commands(ie CMD)
so after doing that save and exit that file
so log-in as surendra
and to access sudo you have to use like below
$sudo /usr/sbin/useradd

Like this we can add as many commands as possible which are not available to normal users

Sudo

sudo cmd   # run a specific command as root
sudo -u svc-acct -H  bash # become a specific user (-u), setting home dir (-H)
# and run the specific shell as command

# simple sudoers file to allow specific users to become root.
# minimal fuss :)
User_Alias SUPERUSERS = sa admin toor
SUPERUSERS      ALL=(ALL) ALL
# User privilege specification
root     ALL=(ALL) ALL
tinh            ALL=(ALL) ALL  # could have placed this user in alias section also

# sudoers eg (2)
# simple file that enable apache/oracle to start as root
# User alias specification
User_Alias      APACHE = applmgr
# Cmnd alias specification
Cmnd_Alias      HTTP_CMD = /u01/applmgr/ORADEVcomn/admin/scripts/ORADEV_oadevapp1/adapcctl.sh, \
/u01/applmgr/ORADEVora/iAS/Apache/Apache/bin/apachectl,  \
/u01/applmgr/ORADEVora/iAS/Apache/Apache/bin/httpd
Cmnd_Alias      TEST_CMD = /usr/bin/cat, /usr/bin/echo
APACHE  ALL = NOPASSWD: HTTP_CMD, TEST_CMD

# longer sudoers eg, (probably for the older version of sudo)
# http://www.courtesan.com/sudo/man/sudoers.html#examples
#
# User alias specification
User_Alias     REAL_ADMIN = tho, joycec, hhuynh
User_Alias     PSEUDO_ADMIN = jmedlin, terry
User_Alias     HELPDESK = wtang, sa
User_Alias     WEBMASTERS = lonly
Runas_Alias    OP = root, operatora
Runas_Alias    DB = oracle, sybase
# Host alias specification
Host_Alias     SPARC = its01, ges-sun2, trout :\
HPUX  = cod, riptide :\
AIX   = brine, chicklet :\
LINUX = toolbox, ldap09 :\
SGI = grolsch, dandelion, black :\
ALPHA = widget, thalamus, foobar :\
HPPA = boa, nag, python
Host_Alias     VLAN28 = 172.27.28.0/255.255.255.0
Host_Alias     CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias     SERVERS = master, mail, www, ns
Host_Alias     CDROM = orion, perseus, hercules
# Cmnd alias specification
Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
/usr/sbin/restore, /usr/sbin/rrestore
Cmnd_Alias     KILL = /usr/bin/kill
Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm
Cmnd_Alias     SHUTDOWN = /usr/sbin/shutdown
Cmnd_Alias     HALT = /usr/sbin/halt
Cmnd_Alias     REBOOT = /usr/sbin/reboot
Cmnd_Alias     SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
/usr/local/bin/tcsh, /usr/bin/rsh, \
/usr/local/bin/zsh
Cmnd_Alias     SU = /usr/bin/su
Cmnd_Alias     TEST = /bin/cat
# User privilege specification
# %group indicate /etc/group
root           ALL = (ALL) ALL
%briosa        ALL = (ALL) ALL
%puser         localhost=/sbin/shutdown -h now
# CAPS are group defined here in sudoers file
REAL_ADMIN     ALL = NOPASSWD: ALL
PSEUDO_ADMIN   ALL = ALL
HELPDESK       ALL = KILL, DUMPS, /bin/ls, /bin/cat
babuv          VLAN28 = ALL
#operatora      ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
#               sudoedit /etc/printcap, /usr/oper/bin/
joe            ALL = /usr/bin/su operatora
bob            SPARC = (OP) ALL : SGI = (OP) ALL
# +netgroup membership (host or username)
jim            +biglab = ALL
+secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
WEBMASTERS     www = (www) ALL, (root) /usr/bin/su www
ALL            CDROM = NOPASSWD: /sbin/umount /CDROM,\
/sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM, \
/sbin/mount  /cdrom, \
/sbin/umount /cdrom, \
/sbin/mount  /mnt/cdrom, \
/sbin/umount /mnt/cdrom 
# end