PREP LAB

Guided Sudo/Sudoers Configuration

< Shield House

OBJECTIVES

0/8 Complete

    SUDO POLICY INTEL

    MISSION BRIEFING

    A departing sysadmin left the sudoers file in a mess. Wide-open NOPASSWD rules and no command restrictions. Walk through each fix to implement proper least-privilege sudo policies.

    # Current /etc/sudoers (DANGEROUS)
    ALL ALL=(ALL) NOPASSWD: ALL
    # No group restrictions
    # No command allow-lists
    # No logging configured

    Key Commands

    cat /etc/sudoers
    View sudoers file
    visudo
    Safely edit sudoers (syntax check)
    sudo -l -U username
    List user's sudo privileges
    groups username
    Show user's group memberships
    usermod -aG group user
    Add user to group
    Why This Matters
    Principle of Least Privilege: users should have only the minimum sudo access they need. An open sudoers file is equivalent to giving everyone the root password. CIS Benchmark 5.3 requires sudo to be configured properly.