sudo rules: give a user exactly the rights they need

“Add them to the sudo group” gives someone the whole machine. Often the real need is much smaller: restart one service, read one log, run one deployment script. sudo can express exactly that, and a precise rule is also an audit trail: every sudo call is logged with the user, the command and the time.

Where rules live and how to edit them

Rules are in /etc/sudoers and in files under /etc/sudoers.d/. Always edit them with visudo: it locks the file, checks the syntax and refuses to save a broken rule. A syntax error in sudoers can disable sudo for everyone, including you. Keep your own rules in separate files so package updates never touch them:

sudo visudo -f /etc/sudoers.d/deploy       # opens an editor, validates on save
sudo visudo -c                              # check every sudoers file
sudo -l                                     # what may I run?
sudo -l -U deploy                           # what may this user run?

Files in sudoers.d must not contain a dot or end in ~, and should be mode 0440. visudo -f takes care of the mode.

Anatomy of a rule

deploy    ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp, /usr/bin/systemctl status myapp

Read it as: user deploy, on ALL hosts (the hostname field matters only when one file is shared across machines), may run as root, without a password, exactly these two commands. Details that matter:

• Commands are full paths. which systemctl tells you the right one; on Debian and Ubuntu it is /usr/bin/systemctl.
• Arguments are part of the match. /usr/bin/systemctl restart myapp allows exactly that; /usr/bin/systemctl alone would allow any systemctl command including poweroff.
• A trailing "" means “no arguments allowed”: /usr/bin/journalctl "".
• Wildcards exist but are dangerous: /usr/bin/systemctl restart my* also matches restart my* ; reboot in some shells and every unit starting with my. Prefer listing commands.
• %name is a group: %operators ALL=(ALL:ALL) ALL is what the sudo and wheel groups get.

Three common patterns

# 1. Full administrator, password required (what the sudo/wheel group already has)
%admins   ALL=(ALL:ALL) ALL

# 2. Operators: manage services and read logs, nothing else
Cmnd_Alias SERVICES = /usr/bin/systemctl start *, /usr/bin/systemctl stop *, /usr/bin/systemctl restart *, /usr/bin/systemctl status *
Cmnd_Alias LOGS     = /usr/bin/journalctl
%operators ALL=(root) SERVICES, LOGS

# 3. Automation account: one script, no password, no shell
ci        ALL=(root) NOPASSWD: /usr/local/bin/deploy-myapp.sh

For pattern 3, the script itself becomes the security boundary: it must be owned by root, not writable by ci (chmod 755, owner root), and must not pass user input to a shell. If ci could edit the script, the NOPASSWD rule would be a root shell.

Commands that are really a root shell

Some programs can start a shell or write any file, so allowing them allows everything: vi, less, find -exec, tee, cp with arbitrary targets, bash, package managers. For editing a specific file use sudoedit (sudo -e), which copies the file, runs the editor as the user and copies it back:

deploy ALL=(root) sudoedit /etc/myapp/myapp.env

Useful Defaults

Defaults timestamp_timeout=5        # minutes before asking the password again (default 15)
Defaults logfile=/var/log/sudo.log  # a dedicated log in addition to the journal
Defaults use_pty                    # run commands in a pseudo-terminal
Defaults:deploy !requiretty         # per-user: allow sudo without a terminal (scripts)

Defaults lines apply globally, Defaults:user to one user. Leave env_reset and secure_path at their defaults; they are what keep a user’s PATH and environment from influencing a root command.

Test before you rely on it

sudo -u deploy sudo -l                      # as root: list the rules deploy gets
sudo -u deploy sudo -n /usr/bin/systemctl status myapp   # -n: fail instead of asking a password
sudo journalctl _COMM=sudo -n 20             # every recent sudo call

Careful: when you tighten rules for your own account, keep a root shell open in another terminal until you have confirmed sudo -v still works for you. On a machine without a root password, that open shell is the only way back.

Official documentation

• sudoers(5)
• visudo(8)
• sudo(8)