How to Add User to Sudoers in CentOS

Introduction

Before we begin talking about how to add user to sudoers in CentOS, let's briefly understand – What is Sudo ?

A command for Unix/Linux that grants elevated privileges. Sudo, short for "superuser do," is a powerful command in the Unix/Linux operating system that allows users to execute tasks with elevated privileges. It enables ordinary users to temporarily become superusers or execute commands as another user, such as the root user.

With Sudo, users can perform critical system actions while maintaining security measures. Understanding Sudo is crucial for system administrators and advanced users to manage and protect their systems effectively.

In this tutorial, you will add user to sudoers in CentOS. We will also address a few FAQs on how to add user to sudoers in CentOS.

Advantages of Sudo

Enhanced security: Sudo provides fine-grained control over user privileges, reducing the risk of unauthorized system access.
Audit trail: Sudo logs all executed commands, allowing for accountability and troubleshooting.
Access control: It enables administrators to delegate specific tasks to non-admin users without compromising system integrity.
Privilege separation: Sudo limits the impact of individual commands, minimizing the potential damage caused by erroneous or malicious actions.
Flexibility: Sudo's configurable settings allow administrators to define precisely which commands and parameters users can execute, ensuring precise control over system resources.

Adding User to the wheel Group

When using CentOS, adding a user to the "wheel" group is the quickest method to give them sudo access. Participants in this group will be required to enter their password whenever they use sudo, but they will have full access to all commands.

There is an expectation that the user already exists. Check out this manual if you need to create a new user.

The user may be added to the group by executing the following command as root or another user with Sudo privileges. Put the user's name in place of "username" to give them the appropriate access.

usermod -aG wheel username

In the vast majority of situations, this approach of granting Sudo access is enough.

Run the whoami command to verify your sudo permissions:

sudo whoami

You'll need to input the password when it asks for it. The command outputs "root" if the user has sudo access.

Output

root

The lack of sudo rights is indicated by the error message "user is not in the sudoers file."

Adding User to the sudoers File

The /etc/sudoers file controls which users and groups have sudo access. Users may have their own unique set of permissions and security settings by adding them to this file.

The sudoers file, or a new configuration file in the /etc/sudoers.d directory, is where you set permissions for users to use the Sudo command. All of the documents in this folder are automatically added to the sudoers file.

The visudo command is used to modify the /etc/sudoers file. When you save the file, any syntax mistakes will be flagged by this command. The file is not saved if there are any mistakes. A syntax mistake in a text editor might cause you to lose Sudo privileges if you open the file.

The /etc/sudoers file is often opened in vim while using visudo. Simply replace "vim" with "nano" if you're not familiar with vim and want to use nano to make changes to the file.

EDITOR=nano visudo

If you don't want to prompt the user for a password when they execute sudo commands, you may enable passwordless sudo. Launch /etc/sudoers file:

visudo

To the very end of the file, add this line:

username  ALL=(ALL) NOPASSWD:ALL

Quit the editor after saving the file. Be sure to replace "username" with the actual username of the person you're authorizing access for.

The use of sudo to restrict the user's access to just a subset of commands is another prevalent scenario. To restrict access to just du and ping, for instance:

username ALL=(ALL) NOPASSWD:/usr/bin/du,/usr/bin/ping

Create a new file in the /etc/sudoers.d directory with the authorization rules instead of modifying the sudoers file. The same kind of rule should be included here as in the sudoers file.

echo "username  ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/username

When implemented in this manner, sudo permission control becomes more manageable. It doesn't matter what you call the file. It is usual to practice using the username as the filename.

FAQs to Add User to Sudoers in CentOS

Can I add a user to the sudoers file without using the command line?

No, adding a user to the sudoers file requires editing system configuration files, which typically requires the use of the command line.

Can I use the user's email address instead of the username?

No, you must use the actual username defined in CentOS for the user you want to add to the sudoers file.

Do I need to restart any services after modifying the sudoers file?

No, there is no need to restart any services after modifying the sudoers file. The changes take effect immediately.

How do I remove sudo privileges from a user?

To remove sudo privileges from a user, open the sudoers file using visudo and delete the corresponding entry for that user. Save the changes and exit.

Can I grant root access to a user with sudoers in CentOS?

Yes, by adding the user to the sudoers file and granting them all privileges using the entry username ALL=(ALL) ALL, the user will have root access.

Are there any security considerations when using sudo?

It is important to limit sudo access to trusted users, review logs regularly, and ensure the sudoers file has correct permissions to avoid any potential security risks. Regularly updating and patching the system is also crucial for overall security.

Is it possible to restrict root access and only use sudo in CentOS?

Yes, it is recommended to disable direct root login and manage all administrative tasks with sudo access. This enhances security by keeping root privileges limited.