Advanced password manipulation in sudo
Special Privileges
Sudo provides the building blocks to secure your system exactly the way you want it.
If you know sudo, you probably know it from Ubuntu, in which you enter your password in return for temporary root privileges. However, Ubuntu's setup is only one of many for sudo. By editing /etc/sudoers, you can configure sudo's password requirements and other features to secure your system in exactly the way you prefer.
Sudo exists for the purposes of minimizing your exposure when you are root user. Because the root account gives full access to your files, your system is at its most vulnerable when you are root. Consequently, you want to minimize your time as root and perhaps even make the root password hard to find.
The sudoers file takes a lot of options, and a careless choice could lock you out of the root account altogether. To avoid this possibility, always edit /etc/sudoers with the visudo command. Visudo creates a temporary copy of sudoers to edit, then checks it for errors. If any errors are found, visudo gives their approximate location by line and gives you three options: to re-open the editor to correct the errors (e); to exit, discarding your edits (X); or to quit (Q) and save the temporary file to the permanent sudoers file. This last option is something that you obviously should not do unless you are very confident that you know better than visudo, because you could prevent sudoers from working at all. Some compilations of visudo, such as Ubuntu's, list the possible choices, whereas others, such as openSUSE's, do not.
[...]
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia