Usage

  • When using sudo, your password is stored by default for 15 minutes. After that time, you will need to enter your password again.
  • Your password will not be shown on the screen as you type it, not even as a row of stars (******). It is being entered with each keystroke!

sudo

To use sudo on the command line, preface the command with sudo, as below: Example #1

sudo chown bob:bob /home/bob/*

Example #2

sudo /etc/init.d/networking restart

To repeat the last command entered, except with sudo prepended to it, run:

sudo !!

Graphical sudo

You should never use normal sudo to start graphical applications as Root. You should use gksudo (kdesudo on Kubuntu) to run such programs. gksudo sets HOME=~root, and copies .Xauthority to a tmp directory. This prevents files in your home directory becoming owned by Root. (AFAICT, this is all that’s special about the environment of the started process with gksudo vs. sudo).

Recent versions of some flavours might not have gksu installed.

If necessary install and set gksu-properties to sudo.

Examples:

gksudo gedit /etc/fstab

or

kdesudo kate /etc/X11/xorg.conf
  • To run the graphical configuration utilities, simply launch the application via the Administration menu.
  • gksudo and kdesudo simply link to the commands gksu and kdesu

Drag & Drop sudo

This is a trick from this thread on the Ubuntu Forums.

Create a launcher with the following command:

gksudo "gnome-open %u"

When you drag and drop any file on this launcher (it’s useful to put it on the desktop or on a panel), it will be opened as Root with its own associated application. This is helpful especially when you’re editing config files owned by Root, since they will be opened as read only by default with gedit, etc.

Users

Allowing other users to run sudo

To add a new user to sudo, open the Users and Groups tool from System->Administration menu. Then click on the user and then on properties. Choose the User Privileges tab. In the tab, find Administer the system and check that.

  • In Hardy Heron and newer, you must first Unlock, then you can select a user from the list and hit Properties. Choose theUser Privileges tab and check Administer the system.

Warning /!\ In the terminal (for Precise Pangolin, 12.04), this would be:

sudo adduser <username> sudo

where you replace <username> with the name of the user (without the <>).

In previous version of Ubuntu

sudo adduser <username> admin

would have been appropriate, but the admin group has been deprecated and no longer exists in Ubuntu 12.04.

Logging in as another user

Please don’t use this to become Root, see further down in the page for more information about that.

sudo -i -u <username>

For example to become the user amanda for tape management purposes.

sudo -i -u amanda

The password being asked for is your own, not amanda’s.

root account

Enabling the root account

IconsPage/warning.png

Enabling the Root account is rarely necessary. Almost everything you need to do as administrator of an Ubuntu system can be done via sudo or gksudo. If you really need a persistent Root login, the best alternative is to simulate a Root login shell using the following command…

IconsPage/warning.png

sudo -i

To enable the Root account (i.e. set a password) use:

sudo passwd root

Use at your own risk!

IconsPage/dont.png

Logging in to X as root may cause very serious trouble. If you believe you need a root account to perform a certain action, please consult the official support channels first, to make sure there is not a better alternative.

IconsPage/dont.png

Re-disabling your root account

IconsPage/info.png

If for some reason you have enabled your root account and wish to disable it again, use the following command in terminal…

IconsPage/info.png

sudo passwd -dl root

Other Information

Misconceptions

  • Isn’t sudo less secure than su?

    • The basic security model is the same, and therefore these two systems share their primary weaknesses. Any user who uses su or sudo must be considered to be a privileged user. If that user’s account is compromised by an attacker, the attacker can also gain root privileges the next time the user does so. The user account is the weak link in this chain, and so must be protected with the same care as Root.

      On a more esoteric level, sudo provides some features which encourage different work habits, which can positively impact the security of the system. sudo is commonly used to execute only a single command, while su is generally used to open a shell and execute multiple commands. The sudo approach reduces the likelihood of a root shell being left open indefinitely, and encourages the user to minimize their use of root privileges.

  • I won’t be able to enter single-user mode!

    • The sulogin program in Ubuntu is patched to handle the default case of a locked root password.
  • I can get a root shell from the console without entering a password!

    • You have to enter your password.

      Console users have access to the boot loader, and can gain administrative privileges in various ways during the boot process. For example, by specifying an alternate init(8) program. Linux systems are not typically configured to be secure at the console, and additional steps (for example, setting a root password, a boot loader password and a BIOS password) are necessary in order to make them so. Note that console users usually have physical access to the machine and so can manipulate it in other ways as well.

Special notes on sudo and shells

None of the methods below are suggested or supported by the designers of Ubuntu.

Please do not suggest this to others unless you personally are available 24/7 to support the user if they have issues as a result of running a shell as Root.

To start a root shell (i.e. a command window where you can run Root commands), starting Root’s environment and login scripts, use:

sudo -i     (similar to sudo su - , gives you roots environment configuration)

To start a root shell, but keep the current shell’s environment, use:

sudo -s     (similar to sudo su)

For a brief overview of some of the differences between su, su -, and sudo -{i,s} see : Ubuntu Forums Post with nice table .

Summary of the differences found –

                                                     corrupted by user's 
                HOME=/root      uses root's PATH     env vars
sudo -i         Y               Y[2]                 N
sudo -s         N               Y[2]                 Y
sudo bash       N               Y[2]                 Y
sudo su         Y               N[1]                 Y

[1] PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
    probably set by /etc/environment
[2] PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin

For a detailed description of the differences see man su and man sudo .

Remove Password Prompt For sudo

IconsPage/warning.png

If you disable the sudo password for your account, you will seriously compromise the security of your computer. Anyone sitting at your unattended, logged in account will have complete Root access, and remote exploits become much easier for malicious crackers.

IconsPage/warning.png

  • This method is NOT suggested nor supported by the designers of Ubuntu.

  • Please do not suggest this to others unless you personally are available 24/7 to support the user if they have issues as a result of running a shell as Root.

These instructions are to remove the prompt for a password when using the sudo command. The sudo command will still need to be used for Root access though.

Edit the sudoers file

Open a Terminal window. Type in sudo visudo. Add the following line to the END of the file (if not at the end it can be nullified by later entries):

<username> ALL=NOPASSWD: ALL

Replace <username> with your user name (without the <>). This is assuming that Ubuntu has created a group with the same name as your user name, which is typical. You can alternately use the group users or any other such group you are in. Just make sure you are in that group. This can be checked by going to System->Administration->Users and Groups

Example:

michael ALL=NOPASSWD: ALL

Type in ^x to exit. This should prompt for an option to save the file, type in Y to save.

Log out, and then log back in. This should now allow you to run the sudo command without being prompted for a password.

Or to do this for the system wide group sudo

root$ echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

Log out, and then back in.

Reset sudo timeout

You can make sure sudo asks for password next time by running:

sudo -k

Reference:
https://help.ubuntu.com/community/RootSudo

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s