Managing Users and Groups

Managing users is easier if a clear group strategy is implemented. Under Red Hat, each user is assigned to a primary group and can also be a member of upto 15 secondary groups.

<note important> In order to put into practice the exemples in this lesson, you need to become the root user by entering the su - command using the password fenestros. </note>

To see a list of the current groups, use the following command:

[root@centos ~]# cat /etc/group
root:x:0:
bin:x:1:bin,daemon
daemon:x:2:bin,daemon
sys:x:3:bin,adm
adm:x:4:adm,daemon
tty:x:5:
disk:x:6:
lp:x:7:daemon
mem:x:8:
kmem:x:9:
wheel:x:10:
mail:x:12:mail,postfix
uucp:x:14:
man:x:15:
games:x:20:
gopher:x:30:
video:x:39:
dip:x:40:
ftp:x:50:
lock:x:54:
audio:x:63:
nobody:x:99:
users:x:100:
dbus:x:81:
utmp:x:22:
utempter:x:35:
desktop_admin_r:x:499:
desktop_user_r:x:498:
floppy:x:19:
vcsa:x:69:
rpc:x:32:
rtkit:x:497:
avahi-autoipd:x:170:
cdrom:x:11:
tape:x:33:
dialout:x:18:
wbpriv:x:88:
pulse:x:496:
pulse-access:x:495:
fuse:x:494:
haldaemon:x:68:haldaemon
ntp:x:38:
saslauth:x:76:
postdrop:x:90:
postfix:x:89:
abrt:x:173:
rpcuser:x:29:
nfsnobody:x:65534:
gdm:x:42:
stapusr:x:156:
stapsys:x:157:
stapdev:x:158:
sshd:x:74:
tcpdump:x:72:
slocate:x:21:
trainee:x:500:
vboxsf:x:501:

<note important> Note that GID ( Group ID ) of root is always 0 that the GIDs of standard, non-system, users start at 500. </note>

This file has one line per group. In each line there are four fields seperated by the : character.

• The unique group name,
• The group password. An x in this field indicates that we are using the /etc/gshadow file to store encrypted passwords. A ! in this field indicates that the group has no password and that the use of the newgrp command is not possible. We will detail the newgrp command later,
• The unique GID,
• The list of users who have the group as a secondary group.

To see the contents of the /etc/gshadow file, use the following command:

[root@centos ~]# cat /etc/gshadow
root:::
bin:::bin,daemon
daemon:::bin,daemon
sys:::bin,adm
adm:::adm,daemon
tty:::
disk:::
lp:::daemon
mem:::
kmem:::
wheel:::
mail:::mail,postfix
uucp:::
man:::
games:::
gopher:::
video:::
dip:::
ftp:::
lock:::
audio:::
nobody:::
users:::
dbus:!::
utmp:!::
utempter:!::
desktop_admin_r:!::
desktop_user_r:!::
floppy:!::
vcsa:!::
rpc:!::
rtkit:!::
avahi-autoipd:!::
cdrom:!::
tape:!::
dialout:!::
wbpriv:!::
pulse:!::
pulse-access:!::
fuse:!::
haldaemon:!::haldaemon
ntp:!::
saslauth:!::
postdrop:!::
postfix:!::
abrt:!::
rpcuser:!::
nfsnobody:!::
gdm:!::
stapusr:!::
stapsys:!::
stapdev:!::
sshd:!::
tcpdump:!::
slocate:!::
trainee:!!::
vboxsf:!::

This file has one line per group. In each line there are four fields seperated by the : character.

• The unique group name from the /etc/group file,
• The encrypted group password. If this is empty, only the users who are members of the group can use the newgrp command. If the field contains a !, an x or a * it indicates that noone can use the newgrp command,
• The group administrator if one exists,
• The list of users who have the group as a secondary group.

To check if these two files have any anomolies or errors, use the following command:

[root@centos ~]# grpck -r

<note important> The -r switch is used to check the files without making any automatic changes to them. </note>

Two other usefull commands are:

• grpconv
  • this command regenerates a new /etc/gshadow file from the /etc/group file and an existing /etc/gshadow file if it exists,
• grpunconv
  • this command regenerates a new /etc/group file from the /etc/gshadow file and an existing /etc/group file if it exists and thens deletes the /etc/gshadow file.

To see a list of the current users, use the following command:

[root@centos ~]# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
pulse:x:498:496:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
saslauth:x:497:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
trainee:x:500:500:trainee:/home/trainee:/bin/bash
vboxadd:x:496:1::/var/run/vboxadd:/bin/false

<note important> Note that the UID of root is always 0. Standard user UIDs start at 500 whilst system accounts range form 1 to 499. </note>

This file has one line per user. In each line there are seven fields seperated by the : character.

• A unique user name,
• The user password. An x in this field indicates that we are using the /etc/shadow file to store encrypted passwords,
• The UID,
• The GID of the users primary group,
• A comment. This field is often called the GECOS field,
• The user's home directory,
• The user's shell.

To see the contents of the /etc/shadow file, use the following command:

[root@centos ~]# cat /etc/shadow
root:$6$pQn9Y2MFsNBnK9F7$cjqbC6SNRHn1kGE0yCuHEB.vhYNeycWOvAyJuuEbslo3n3qhRcp6p3lEG/YuxwMRtiZ.qIddmVpuTvTEmOa0W.:16003:0:99999:7:::
bin:*:15628:0:99999:7:::
daemon:*:15628:0:99999:7:::
adm:*:15628:0:99999:7:::
lp:*:15628:0:99999:7:::
sync:*:15628:0:99999:7:::
shutdown:*:15628:0:99999:7:::
halt:*:15628:0:99999:7:::
mail:*:15628:0:99999:7:::
uucp:*:15628:0:99999:7:::
operator:*:15628:0:99999:7:::
games:*:15628:0:99999:7:::
gopher:*:15628:0:99999:7:::
ftp:*:15628:0:99999:7:::
nobody:*:15628:0:99999:7:::
dbus:!!:16003::::::
vcsa:!!:16003::::::
rpc:!!:16003:0:99999:7:::
rtkit:!!:16003::::::
avahi-autoipd:!!:16003::::::
pulse:!!:16003::::::
haldaemon:!!:16003::::::
ntp:!!:16003::::::
saslauth:!!:16003::::::
postfix:!!:16003::::::
abrt:!!:16003::::::
rpcuser:!!:16003::::::
nfsnobody:!!:16003::::::
gdm:!!:16003::::::
sshd:!!:16003::::::
tcpdump:!!:16003::::::
trainee:$6$mTKZrZa/PLvGVQ31$RWh2JTMzAclOuhGZXbocPYHssP2DmXyeU7sbK6gpMxuPrYrBK9cn43ti1SSa70YGWJ7n8EXQlyBA8gIZe5xIG.:16003:0:99999:7:::
vboxadd:!!:16003::::::

In each line there are eight fields seperated by the : character:

• The unique user name from the /etc/passwd file,
• The encrypted user password. This field can also hold one of the following :
  • !! - the user password has not yet been set and the account is blocked,
  • * - the account is blocked,
  • empty - the user can connect with an empty password,
• The number of days between the 01/01/1970 and the date of the last change of the password,
• The number of days that the current password is valid. A 0 in this field means that the password will never expire,
• The number of days until the next password change,
• The number of days before the the next password change that the user will receive a notification,
• The number days after the password expiration date that the account will be deactivated if the user does not change the password,
• The number of days, starting from the 01/01/1970, until the account deactivation.

To check if these two files have any anomolies or errors, use the following command:

[root@centos ~]# pwck -r
user 'adm': directory '/var/adm' does not exist
user 'uucp': directory '/var/spool/uucp' does not exist
user 'gopher': directory '/var/gopher' does not exist
user 'ftp': directory '/var/ftp' does not exist
user 'avahi-autoipd': directory '/var/lib/avahi-autoipd' does not exist
user 'pulse': directory '/var/run/pulse' does not exist
user 'saslauth': directory '/var/empty/saslauth' does not exist
user 'vboxadd': directory '/var/run/vboxadd' does not exist
pwck: no changes

<note important> The -r switch is used to check the files without making any automatic changes to them. </note>

Two other usefull commands are:

• pwconv
  • this command regenerates a new /etc/shadow file from the /etc/passwd file and an existing /etc/shadow file if it exists,
• pwunconv
  • this command regenerates a new /etc/passwd file from the /etc/shadow file and an existing /etc/passwd file if it exists and thens deletes the /etc/shadow file.

This command is used to create groups.

[root@centos ~]# groupadd --help
Usage: groupadd [options] GROUP

Options:
  -f, --force                   exit successfully if the group already exists,
                                and cancel -g if the GID is already used
  -g, --gid GID                 use GID for the new group
  -h, --help                    display this help message and exit
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -o, --non-unique              allow to create groups with duplicate
                                (non-unique) GID
  -p, --password PASSWORD       use this encrypted password for the new group
  -r, --system                  create a system account

This command is used to delete groups..

[root@centos ~]# groupdel --help
groupdel: group '--help' does not exist

The command is used to modify an existing group.

[root@centos ~]# groupmod --help
Usage: groupmod [options] GROUP

Options:
  -g, --gid GID                 change the group ID to GID
  -h, --help                    display this help message and exit
  -n, --new-name NEW_GROUP      change the name to NEW_GROUP
  -o, --non-unique              allow to use a duplicate (non-unique) GID
  -p, --password PASSWORD       change the password to this (encrypted)
                                PASSWORD

This command is used to temporarily change the user's primary group.

[root@centos ~]# newgrp --help
Usage: newgrp [-] [group]

This command is used to administer the /etc/group file.

[root@centos ~]# gpasswd --help
gpasswd: unrecognized option '--help'
Usage: gpasswd [option] GROUP

Options:
  -a, --add USER                add USER to GROUP
  -d, --delete USER             remove USER from GROUP
  -r, --remove-password         remove the GROUP's password
  -R, --restrict                restrict access to GROUP to its members
  -M, --members USER,...        set the list of members of GROUP
  -A, --administrators ADMIN,...
                                set the list of administrators for GROUP
Except for the -A and -M options, the options cannot be combined.

This command is used to add users.

The exit codes of the useradd command are :

[root@centos ~]# useradd --help
Usage: useradd [options] LOGIN

Options:
  -b, --base-dir BASE_DIR       base directory for the home directory of the
                                new account
  -c, --comment COMMENT         GECOS field of the new account
  -d, --home-dir HOME_DIR       home directory of the new account
  -D, --defaults                print or change default useradd configuration
  -e, --expiredate EXPIRE_DATE  expiration date of the new account
  -f, --inactive INACTIVE       password inactivity period of the new account
  -g, --gid GROUP               name or ID of the primary group of the new
                                account
  -G, --groups GROUPS           list of supplementary groups of the new
                                account
  -h, --help                    display this help message and exit
  -k, --skel SKEL_DIR           use this alternative skeleton directory
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -l, --no-log-init             do not add the user to the lastlog and
                                faillog databases
  -m, --create-home             create the user's home directory
  -M, --no-create-home          do not create the user's home directory
  -N, --no-user-group           do not create a group with the same name as
                                the user
  -o, --non-unique              allow to create users with duplicate
                                (non-unique) UID
  -p, --password PASSWORD       encrypted password of the new account
  -r, --system                  create a system account
  -s, --shell SHELL             login shell of the new account
  -u, --uid UID                 user ID of the new account
  -U, --user-group              create a group with the same name as the user
  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping

This command is used to delete users.

[root@centos ~]# userdel --help
Usage: userdel [options] LOGIN

Options:
  -f, --force                   force removal of files,
                                even if not owned by user
  -h, --help                    display this help message and exit
  -r, --remove                  remove home directory and mail spool
  -Z, --selinux-user            remove SELinux user from SELinux user mapping

This command is used to modify an existing user.

[root@centos ~]# usermod --help
Usage: usermod [options] LOGIN

Options:
  -c, --comment COMMENT         new value of the GECOS field
  -d, --home HOME_DIR           new home directory for the user account
  -e, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE
  -f, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -g, --gid GROUP               force use GROUP as new primary group
  -G, --groups GROUPS           new list of supplementary GROUPS
  -a, --append                  append the user to the supplemental GROUPS
                                mentioned by the -G option without removing
                                him/her from other groups
  -h, --help                    display this help message and exit
  -l, --login NEW_LOGIN         new value of the login name
  -L, --lock                    lock the user account
  -m, --move-home               move contents of the home directory to the
                                new location (use only with -d)
  -o, --non-unique              allow using duplicate (non-unique) UID
  -p, --password PASSWORD       use encrypted password for the new password
  -s, --shell SHELL             new login shell for the user account
  -u, --uid UID                 new UID for the user account
  -U, --unlock                  unlock the user account
  -Z, --selinux-user            new SELinux user mapping for the user account

This command is used to create or change a user's password.

[root@centos ~]# passwd --help
Usage: passwd [OPTION...] <accountName>
  -k, --keep-tokens       keep non-expired authentication tokens
  -d, --delete            delete the password for the named account (root only)
  -l, --lock              lock the password for the named account (root only)
  -u, --unlock            unlock the password for the named account (root only)
  -e, --expire            expire the password for the named account (root only)
  -f, --force             force operation
  -x, --maximum=DAYS      maximum password lifetime (root only)
  -n, --minimum=DAYS      minimum password lifetime (root only)
  -w, --warning=DAYS      number of days warning users receives before
                          password expiration (root only)
  -i, --inactive=DAYS     number of days after password expiration when an
                          account becomes disabled (root only)
  -S, --status            report password status on the named account (root
                          only)
  --stdin                 read new tokens from stdin (root only)

Help options:
  -?, --help              Show this help message
  --usage                 Display brief usage message

The default behaviour of the useradd command is configured by the contents of the /etc/default/useradd file:

[root@centos ~]# cat /etc/default/useradd
# useradd defaults file
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes

In this file we can find:

• GROUP - indicates the default primary group for a new user when the useradd command is used with the -N switch. If the switch is not used, the user's primary roup will be either the group specified by the -g switch or a group having the same name as the user,
• HOME - indicates the directory under which all home directories will be created but only if this behaviour is authorized in the /etc/login.defs file,
• INACTIVE - The number days after the password expiration date that the account will be deactivated if the user does not change the password. A -1 in this field deactivates this behaviour,
• EXPIRE - indicates in the above example that the password will never expire,
• SHELL - indicates the shell to be assigned to the user,
• SKEL - indicates the directory in which are stored the files that will be copied to the user's home directory upon creation,
• CREATE_MAIL_SPOOL - indicates if the user's mailbox will be created.

This information can also be viewed by using the useradd command :

[root@centos ~]# useradd -D
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes

To see a list of the files in /etc/skel, use the following command:

[root@centos ~]# ls -la /etc/skel
total 36
drwxr-xr-x.   4 root root  4096 Oct 25 10:30 .
drwxr-xr-x. 113 root root 12288 Oct 27 17:00 ..
-rw-r--r--.   1 root root    18 Jul 18 15:15 .bash_logout
-rw-r--r--.   1 root root   176 Jul 18 15:15 .bash_profile
-rw-r--r--.   1 root root   124 Jul 18 15:15 .bashrc
drwxr-xr-x.   2 root root  4096 Nov 12  2010 .gnome2
drwxr-xr-x.   4 root root  4096 Oct 25 09:33 .mozilla

To identify a user's UID, GID and secondary groups, if any, use the following command:

[root@centos ~]# id trainee
uid=500(trainee) gid=500(trainee) groups=500(trainee)

To identify the user's groups we can also use the following command:

[root@centos ~]# groups trainee
trainee : trainee

The ranges of UIDs and GIDs that can be used are configured in the /etc/login.defs file:

...
#
# Min/max values for automatic uid selection in useradd
#
UID_MIN			  500
UID_MAX			60000

#
# Min/max values for automatic gid selection in groupadd
#
GID_MIN			  500
GID_MAX			60000
...

Create three groups, group1, group2 et group3. The GID of group3 needs to set at 807 :

[root@centos ~]# groupadd group1; groupadd group2; groupadd -g 807 group3

Now create three users fenestros1, fenestros2 and fenestros3. The three users have as their primary group group1, group2 and group3 respectively. fenestros2 is also a member of group1 and group3. fenestros1 has a GECOS of tux1:

[root@centos ~]# useradd -g group2 fenestros2; useradd -g 807 fenestros3; useradd -g group1 fenestros1
[root@centos ~]# usermod -G group1,group3 fenestros2
[root@centos ~]# usermod -c "tux1" fenestros1

Now look at the bottom of the /etc/passwd file:

[root@centos ~]# cat /etc/passwd
...
fenestros2:x:501:503::/home/fenestros2:/bin/bash
fenestros3:x:502:807::/home/fenestros3:/bin/bash
fenestros1:x:503:502:tux1:/home/fenestros1:/bin/bash

Now look at the bottom of the /etc/group file:

[root@centos ~]# cat /etc/group
...
group1:x:502:fenestros2
group2:x:503:
group3:x:807:fenestros2

Create a password for group3:

[root@centos ~]# gpasswd group3
Changing the password for group group3
New Password: fenestros
Re-enter new password: fenestros 

<note important> Note that the passwords will not be visible. </note>

Now look at the bottom of the /etc/gshadow file:

[root@centos ~]# cat /etc/gshadow
...
group1:!::fenestros2
group2:!::
group3:$6$C1Itl7VHeUq05g$Mr2Re7ry6Gnp3.Ad2Ym50H9P5WIDgDZpx/woEgcPTYAqba3v71xX6Er1RP9OuK0Hw/DVRYaI/qiq/GJ1b3PkH1::fenestros2

<note important> Note the presence of an encrypted password for group3. </note>

Make fenestros1 administrator of group3 :

[root@centos ~]# gpasswd -A fenestros1 group3

Now look at the bottom of the /etc/gshadow file:

[root@centos ~]# cat /etc/gshadow
...
group1:!::fenestros2
group2:!::
group3:$6$C1Itl7VHeUq05g$Mr2Re7ry6Gnp3.Ad2Ym50H9P5WIDgDZpx/woEgcPTYAqba3v71xX6Er1RP9OuK0Hw/DVRYaI/qiq/GJ1b3PkH1:fenestros1:fenestros2

<note important> fenestros1 can now use the group password to add or remove users from the group. </note>

Try to delete group3:

[root@centos ~]#  groupdel group3
groupdel: cannot remove the primary group of user 'fenestros3'

<note important> Note that you cannot remove the primary group of a user. </note>

Delete user fenestros3 :

[root@centos ~]# userdel fenestros3

Try to delete group3 again:

[root@centos ~]# groupdel group3

<note important> This time the command does not return an error even though user fenestros2 had the group as a secondary group. </note>

If you delete a user without using the -r switch, the user's files remain on the system :

[root@centos ~]# ls -ld /home/fenestros3
drwx------. 4 502 group3 4096 Oct 28 18:24 /home/fenestros3

In order to remove the files use the find command:

[root@centos ~]# find /home -user 502 -exec rm -rf {} \;
find: `/home/fenestros3': No such file or directory

<note important> The final error is normal. All it means is that there are no more files to delete. </note>

Now create the passwords for users fenestros1 et fenestros2:

[root@centos ~]# passwd fenestros1
Changing password for user fenestros1.
New password: fenestros1
BAD PASSWORD: it is based on a dictionary word
Retype new password: fenestros1
passwd: all authentication tokens updated successfully.
[root@centos ~]# passwd fenestros2
Changing password for user fenestros2.
New password: fenestros2
BAD PASSWORD: it is based on a dictionary word
Retype new password: fenestros2
passwd: all authentication tokens updated successfully.

<note important> Note that the passwords will not be visible. Note also that the rules for creating passwords do not apply to passwords created by root. </note>

You are now going to become fenestros2, at first without his environment settings and then with his environment settings.

Firstly check where you are:

[root@centos ~]# pwd
/root

Use the su (switch user) command to become fenestros2 without his environment settings :

[root@centos ~]# su fenestros2
[fenestros2@centos root]$ pwd
/root
[fenestros2@centos root]$ 

<note> Note that you are still in the /root directory. This means that despite becoming fenestros2, you still have root's environment settings. </note>

<note important> Environment settings include, amongst other things, the user's home directory and the value of the PATH variable. </note>

Type exit to become root again:

[fenestros2@centos root]$ exit
exit

Use the su - (switch user) command to become fenestros2 with his environment settings : :

[root@centos ~]# su - fenestros2
[fenestros2@centos ~]$ pwd
/home/fenestros2

<note important> Note that you have landed in fenestros2's home directory. Also note that root can become any user on the system without any knowledge of the user's password. </note>

Type exit to become root again:

[fenestros2@centos ~]$ exit
logout
[root@centos ~]# 

The sudo command allows a user to execute a command as root or as anoher user. The effective UID and GID of the user invoking sudo are those of the target user, allowing for a simple but effective way of delegating system administration.

The sudo command is configured by the contents of the /etc/sudoers file:

[root@centos ~]# cat /etc/sudoers
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
## 
## This file must be edited with the 'visudo' command.

## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using 
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2

## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem


## Command Aliases
## These are groups of related commands...

## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb

## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 

## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe

# Defaults specification

#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
#         You have to run "ssh -t hostname sudo <cmd>".
#
Defaults    requiretty

#
# Refuse to run if unable to disable echo on the tty. This setting should also be
# changed in order to be able to use sudo without a tty. See requiretty above.
#
Defaults   !visiblepw

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults    always_set_home

Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults   env_keep += "HOME"

Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on 
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## 	user	MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere 
root	ALL=(ALL) 	ALL

## Allows members of the 'sys' group to run networking, software, 
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
# %wheel	ALL=(ALL)	ALL

## Same thing without a password
# %wheel	ALL=(ALL)	NOPASSWD: ALL

## Allows members of the users group to mount and unmount the 
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

<note important> Note the presence of the # %wheel ALL=(ALL) ALL line. This line has the following format <WHO> <FROM WHERE> = (<AS WHO>) <WHAT>. This line effectively states that all members of the wheel group (%wheel) can execute all commands on the system from anywhere, as anyone. </note>

To edit the /etc/sudoers file you must use the following command:

# visudo

Edit the file by removing the # character in front of the following line:

...
# %wheel	ALL=(ALL) ALL
...

Save the file and exit vi.

~~DISCUSSION:off~~

<html> <center> Copyright © 2011-2014 Hugh Norris.<br><br> <a rel=“license” href=“http://creativecommons.org/licenses/by-nc-nd/3.0/”><img alt=“Creative Commons License” style=“border-width:0” src=“https://i.creativecommons.org/l/by-nc-nd/3.0/88x31.png” /></a><br />This work is licensed under a <a rel=“license” href=“http://creativecommons.org/licenses/by-nc-nd/3.0/”>Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License</a> </center> </html>