2. sudo and sudoers command.md

🔐 Linux sudo Command and sudoers File Configuration

The sudo (Superuser Do) command allows authorized users to execute commands with root privileges or another user’s permissions, as defined in the /etc/sudoers file.

---

📌 1. sudo Command – Run Commands with Elevated Privileges

✅ Basic Usage – Run a Command as Root

sudo ls /root

🔹 Runs ls /root with root privileges.
🔹 You will be prompted for your password.

---

✅ 1.1 Run a Command as Another User (-u)

sudo -u nikhil whoami

✅ Output

nikhil

🔹 Runs whoami as user nikhil.

---

✅ 1.2 Execute Multiple Commands (&&)

sudo bash -c "whoami && id"

✅ Output

root
uid=0(root) gid=0(root) groups=0(root)

🔹 Runs multiple commands as root.

---

✅ 1.3 Open a Root Shell (sudo -s)

sudo -s
whoami

✅ Output

root

🔹 Opens a root shell.

---

✅ 1.4 Switch to a Root Login Shell (sudo -i)

sudo -i

🔹 Logs in as root, loading root's environment.

---

✅ 1.5 Run a Command Without Saving It in History

sudo visudo

🔹 Runs visudo without saving it in shell history.

---

📌 2. sudoers File – Configuring User Privileges

To configure who can use sudo and for which commands, edit the /etc/sudoers file using visudo:

sudo visudo

🔹 visudo prevents syntax errors that could lock you out.

---

✅ 2.1 Grant Full Root Privileges to a User

nikhil ALL=(ALL:ALL) ALL

🔹 nikhil can run any command as any user or group.

---

✅ 2.2 Allow a User to Run Specific Commands

jaydeep ALL=(ALL) /usr/sbin/apt update, /usr/bin/systemctl restart apache2

🔹 jaydeep can only run package updates and restart Apache.

---

✅ 2.3 Allow a User to Run Commands Without a Password (NOPASSWD)

jaydeep ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart apache2

🔹 jaydeep can restart Apache without a password.

---

✅ 2.4 Restrict a User to Specific Commands

nikhil ALL=(ALL) /usr/bin/ls, /usr/bin/cat

🔹 nikhil can only run ls and cat with sudo.

---

✅ 2.5 Grant a Group (%groupname) Specific Permissions

%developers ALL=(ALL) NOPASSWD: /usr/bin/mkdir, PASSWD: /usr/bin/rm

🔹 The developers group can create directories without a password but must enter a password to delete files.

---

✅ 2.6 Allow a Web Server User (www-data) to Restart Apache

%www-data ALL=(ALL:ALL) NOPASSWD: /usr/bin/systemctl restart apache2

🔹 Web server processes can restart Apache without a password.

---

✅ 2.7 Creating Command Aliases for Easier Management

Cmnd_Alias WEB_CMDS = /usr/bin/systemctl restart apache2, /usr/bin/systemctl reload nginx

jaydeep ALL=(ALL) NOPASSWD: WEB_CMDS

🔹 Defines a command alias (WEB_CMDS) and assigns it to jaydeep.

---

📊 Summary of sudoers Rules

Rule	Description
nikhil ALL=(ALL:ALL) ALL	nikhil can run all commands as any user
jaydeep ALL=(ALL) /usr/bin/systemctl restart apache2	jaydeep can only restart Apache
jaydeep ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart apache2	jaydeep can restart Apache without a password
%developers ALL=(ALL) NOPASSWD: /usr/bin/mkdir, PASSWD: /usr/bin/rm	Developers can create directories without a password but must enter a password to delete files
%www-data ALL=(ALL:ALL) NOPASSWD: /usr/bin/systemctl restart apache2	www-data can restart Apache without a password
Cmnd_Alias WEB_CMDS = /usr/bin/systemctl restart apache2, /usr/bin/systemctl reload nginx	Defines a command alias (WEB_CMDS) for web services

---