What do the lines for root, sudo and wheel in sudoers mean?
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo
edited 9 mins ago
G-Man
13.1k93465
asked 6 hours ago
J. DoeJ. Doe
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo
edited 9 mins ago
G-Man
13.1k93465
asked 6 hours ago
J. DoeJ. Doe
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
5 hours ago
add a comment |
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo
edited 9 mins ago
G-Man
13.1k93465
asked 6 hours ago
J. DoeJ. Doe
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I am trying to understand the sudoers file, but I have a few things that I don't understand.
This line:
root ALL=(ALL) ALL
Users in root on any host (what does host mean, can you give me the real example) can run any command as any user.
What would happen if I deleted this line?
And if I added this line: username=ALL(ALL) ALL, does it mean, that username has the same permissions as root because both of them have the same settings?
I also have a line with %sudo ALL=(ALL) ALL, but if I list the groups I cannot see any group called sudo.
And I also have a line %wheel ALL=(ALL) ALL, but why do I have this line and the line with sudo? Aren't these lines the same?
sudo
sudo
edited 9 mins ago
G-Man
13.1k93465
asked 6 hours ago
J. DoeJ. Doe
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 9 mins ago
G-Man
13.1k93465
asked 6 hours ago
J. DoeJ. Doe
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 9 mins ago
G-Man
13.1k93465
edited 9 mins ago
G-Man
13.1k93465
edited 9 mins ago
G-Man
13.1k93465
13.1k93465
asked 6 hours ago
J. DoeJ. Doe
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 6 hours ago
J. DoeJ. Doe
1
asked 6 hours ago
J. DoeJ. Doe
1
1
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
J. Doe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
5 hours ago
add a comment |
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
5 hours ago
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
5 hours ago
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
5 hours ago
add a comment |
1 Answer
1
active
oldest
votes
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered 6 hours ago
KusalanandaKusalananda
130k17247407
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
5 hours ago
|
show 9 more comments
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
J. Doe is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501247%2fwhat-do-the-lines-for-root-sudo-and-wheel-in-sudoers-mean%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered 6 hours ago
KusalanandaKusalananda
130k17247407
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
5 hours ago
|
show 9 more comments
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered 6 hours ago
KusalanandaKusalananda
130k17247407
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
5 hours ago
|
show 9 more comments
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered 6 hours ago
KusalanandaKusalananda
130k17247407
The hostname can be specified in the sudoers file as a specific host or a set of hosts. This allows an administrator to distribute a single copy of the file to multiple hosts without needing to tailor each file for each host. A user on one host may have sudo access to a particular command only, while the same user has sudo access to another command or set of commands on another host. The sudoers files on both host could be left identical.
You should not delete the line that gives root the ability to use sudo. Allowing root to use sudo means allowing somebody that is already logged in as root to execute a command as another user easily (and also have it logged, for auditing).
A line saying username=ALL(ALL) ALL would contain a syntax error. Using username ALL=(ALL) ALL would give the user username the ability to execute sudo to run any command.
The sudo group may not exist on your system. There is nothing stopping you from creating it though, and to add users that should have full sudo access to that group. This facility allows you to administrate sudo access by adding and removing users to the named group, so no editing of the sudoers file is needed to add or to remove the sudo access for a user.
The wheel group is mostly used on BSD systems, and is traditionally the primary group for the root user on those systems. Again, your system may not have this group.
See also
The wheel group (Wikipedia)
answered 6 hours ago
KusalanandaKusalananda
130k17247407
edited 6 hours ago
answered 6 hours ago
KusalanandaKusalananda
130k17247407
answered 6 hours ago
KusalanandaKusalananda
130k17247407
answered 6 hours ago
KusalanandaKusalananda
130k17247407
130k17247407
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
5 hours ago
|
show 9 more comments
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing thesudoersfile. Making mistakes in that file could have serious or at least very inconvenient consequences.
– Kusalananda
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
@J.Doe I believe I covered those points in my answer.sudowould still deny root from usingsudoif you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of thesudoprogram). The other difference that you ask about is a difference in how you administratesudoprivileges. I mentioned this too. You either add users individually to thesudoersfile, but this may be to bothersome on large systems, so it may be easier to add users to a specialsudogroup.
– Kusalananda
5 hours ago
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
Thanks for your reply. What does it mean root user? Is it user with same permissions as root?
– J. Doe
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe All Unix systems has a root user (also sometimes called the "superuser"). The root user have no restrictions, can read and delete any file on the system and install software etc. You should not be using the root user's account for much, and only for very brief periods of time. See e.g. en.wikipedia.org/wiki/Superuser and linfo.org/root.html
– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing the
sudoers file. Making mistakes in that file could have serious or at least very inconvenient consequences.– Kusalananda
5 hours ago
@J.Doe You should probably familiarise yourself with the system as an ordinary non-root user before you start changing the
sudoers file. Making mistakes in that file could have serious or at least very inconvenient consequences.– Kusalananda
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
If root can everything, why I have this line in sudoers? And what is difference between username ALL=(ALL) ALL and user in group ALL=(ALL) ALL?
– J. Doe
5 hours ago
@J.Doe I believe I covered those points in my answer.
sudo would still deny root from using sudo if you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of the sudo program). The other difference that you ask about is a difference in how you administrate sudo privileges. I mentioned this too. You either add users individually to the sudoers file, but this may be to bothersome on large systems, so it may be easier to add users to a special sudo group.– Kusalananda
5 hours ago
@J.Doe I believe I covered those points in my answer.
sudo would still deny root from using sudo if you deleted that line (it has nothing to do with what root can or cannot do as superuser, it only has to do with the logic of the sudo program). The other difference that you ask about is a difference in how you administrate sudo privileges. I mentioned this too. You either add users individually to the sudoers file, but this may be to bothersome on large systems, so it may be easier to add users to a special sudo group.– Kusalananda
5 hours ago
|
show 9 more comments
J. Doe is a new contributor. Be nice, and check out our Code of Conduct.
J. Doe is a new contributor. Be nice, and check out our Code of Conduct.
J. Doe is a new contributor. Be nice, and check out our Code of Conduct.
J. Doe is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501247%2fwhat-do-the-lines-for-root-sudo-and-wheel-in-sudoers-mean%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
There is a spelling error in “username=ALL(ALL) ALL” should be “username ALL=(ALL) ALL”
– ctrl-alt-delor
5 hours ago