|
| 1 | +## sudoers file. |
| 2 | +## |
| 3 | +## This file MUST be edited with the 'visudo' command as root. |
| 4 | +## Failure to use 'visudo' may result in syntax or file permission errors |
| 5 | +## that prevent sudo from running. |
| 6 | +## |
| 7 | +## See the sudoers man page for the details on how to write a sudoers file. |
| 8 | +## |
| 9 | + |
| 10 | +## |
| 11 | +## Host alias specification |
| 12 | +## |
| 13 | +## Groups of machines. These may include host names (optionally with wildcards), |
| 14 | +## IP addresses, network numbers or netgroups. |
| 15 | +# Host_Alias WEBSERVERS = www1, www2, www3 |
| 16 | + |
| 17 | +## |
| 18 | +## User alias specification |
| 19 | +## |
| 20 | +## Groups of users. These may consist of user names, uids, Unix groups, |
| 21 | +## or netgroups. |
| 22 | +# User_Alias ADMINS = millert, dowdy, mikef |
| 23 | + |
| 24 | +## |
| 25 | +## Cmnd alias specification |
| 26 | +## |
| 27 | +## Groups of commands. Often used to group related commands together. |
| 28 | +# Cmnd_Alias PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \ |
| 29 | +# /usr/bin/pkill, /usr/bin/top |
| 30 | +# Cmnd_Alias REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff |
| 31 | + |
| 32 | +## |
| 33 | +## Defaults specification |
| 34 | +## |
| 35 | +## You may wish to keep some of the following environment variables |
| 36 | +## when running commands via sudo. |
| 37 | +## |
| 38 | +## Locale settings |
| 39 | +# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET" |
| 40 | +## |
| 41 | +## Run X applications through sudo; HOME is used to find the |
| 42 | +## .Xauthority file. Note that other programs use HOME to find |
| 43 | +## configuration files and this may lead to privilege escalation! |
| 44 | +# Defaults env_keep += "HOME" |
| 45 | +## |
| 46 | +## X11 resource path settings |
| 47 | +# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH" |
| 48 | +## |
| 49 | +## Desktop path settings |
| 50 | +# Defaults env_keep += "QTDIR KDEDIR" |
| 51 | +## |
| 52 | +## Allow sudo-run commands to inherit the callers' ConsoleKit session |
| 53 | +# Defaults env_keep += "XDG_SESSION_COOKIE" |
| 54 | +## |
| 55 | +## Uncomment to enable special input methods. Care should be taken as |
| 56 | +## this may allow users to subvert the command being run via sudo. |
| 57 | +# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER" |
| 58 | +## |
| 59 | +## Uncomment to use a hard-coded PATH instead of the user's to find commands |
| 60 | +# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" |
| 61 | +## |
| 62 | +## Uncomment to send mail if the user does not enter the correct password. |
| 63 | +# Defaults mail_badpass |
| 64 | +## |
| 65 | +## Uncomment to enable logging of a command's output, except for |
| 66 | +## sudoreplay and reboot. Use sudoreplay to play back logged sessions. |
| 67 | +# Defaults log_output |
| 68 | +# Defaults!/usr/bin/sudoreplay !log_output |
| 69 | +# Defaults!/usr/local/bin/sudoreplay !log_output |
| 70 | +# Defaults!REBOOT !log_output |
| 71 | + |
| 72 | +## |
| 73 | +## Runas alias specification |
| 74 | +## |
| 75 | + |
| 76 | +## |
| 77 | +## User privilege specification |
| 78 | +## |
| 79 | +root ALL=(ALL) ALL |
| 80 | + |
| 81 | +## Uncomment to allow members of group wheel to execute any command |
| 82 | +# %wheel ALL=(ALL) ALL |
| 83 | + |
| 84 | +## Same thing without a password |
| 85 | +# %wheel ALL=(ALL) NOPASSWD: ALL |
| 86 | + |
| 87 | +## Uncomment to allow members of group sudo to execute any command |
| 88 | +# %sudo ALL=(ALL) ALL |
| 89 | + |
| 90 | +## Uncomment to allow any user to run sudo if they know the password |
| 91 | +## of the user they are running the command as (root by default). |
| 92 | +# Defaults targetpw # Ask for the password of the target user |
| 93 | +# ALL ALL=(ALL) ALL # WARNING: only use this together with 'Defaults targetpw' |
| 94 | + |
| 95 | +## Read drop-in files from /etc/sudoers.d |
| 96 | +@includedir /etc/sudoers.d |
| 97 | +## Same thing without a password |
| 98 | +ray ALL=(ALL) NOPASSWD: ALL |
0 commit comments