Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How does the ubuntu user on the AWS images for Ubuntu Server 12.04 have passwordless sudo for all commands when there is no configuration for it in /etc/sudoers?

I'm using Ubuntu server 12.04 on Amazon. I want to add a new user that has the same behavior as the default Ubuntu user. Specifically I want passwordless sudo for this new user.

So I've added a new user and went to edit /etc/sudoers (using visudo of course). From reading that file it seemed like the default ubuntu user was getting it's passwordless sudo from being a member of the admin group. So I added my new user to that. Which didn't work. Then I tried adding the NOPASSWD directive to sudoers. Which also didn't work.

Anyway, now I'm just curious. How does the ubuntu user get passwordless privileges if they aren't defined in /etc/sudoers. What is the mechanism that allows this?

share|improve this question

3 Answers 3

Short answer without using any editor (tested on bash)

Set sudo without password for the current user

sudo echo "$USER ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers

Verify if you can use sudo without password ...

sudo cat /etc/sudoers | grep "$USER"

.. or simply try it with

sudo <anything>
share|improve this answer
1  
This is pretty dangerous advice... copy and paste this wrong and you'll lock yourself out of your own server. Hence the advice to use visudo. It checks that the syntax is correct before saving to disk. So, for anyone that wants to use this. Don't do it on a remote server that you care about. You might want to include a warning about that in your answer. –  aychedee Aug 14 at 9:25
    
For a non-permanent solution, that works. –  jiminikiz Sep 10 at 16:47

So I find that the most straight forward thing to do, in order to easily replicate this behavior across multiple servers, was the following:

sudo visudo

Change this line:

# Members of the admin group may gain root privileges
%admin  ALL=(ALL) ALL

to this line:

# Members of the admin group may gain root privileges
%admin  ALL=(ALL) NOPASSWD:ALL

And move it under this line:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

you should now have this:

# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#

Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin  ALL=(ALL) NOPASSWD:ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

then for every user that needs sudo access with WITH a password:

sudo adduser <user> sudo

and for every user that needs sudo access WITH NO password:

sudo adduser <user> admin

and finally, run this:

sudo service sudo restart

And that's it!

share|improve this answer
    
Note to self: It's a convention to move less restrictive permissions lower in the stack. But not doing it won't affect functionality. –  poweratom Sep 5 at 9:47
up vote 68 down vote accepted

Okay, I have discovered the answer so may as well put it here for completeness. At the end of /etc/sudoers there is what I thought was just a comment:

#includedir /etc/sudoers.d

However this actually includes the contents of that directory. Inside of which is the file /etc/sudoers.d/90-cloudimg-ubuntu. Which has the expected contents

# ubuntu user is default user in cloud-images.
# It needs passwordless sudo functionality.
ubuntu ALL=(ALL) NOPASSWD:ALL

So that is where the sudo configuration for the default ubuntu user lives.

You should edit this file using visudo. The following command will let you edit the correct file with visudo.

sudo visudo -f /etc/sudoers.d/90-cloudimg-ubuntu

And add a line like:

aychedee ALL=(ALL) NOPASSWD:ALL

At the end.

share|improve this answer
    
I am currently struggling with /etc/sudoers on ubuntu-12.04 (desk x86_64). After altering /etc/sudoers or /etc/sudoers.d/*, do I need to reboot, logout or sudo restart any daemon? –  m-ric Feb 14 '13 at 16:11
1  
I'm pretty sure I had to do a full reboot. –  aychedee Feb 14 '13 at 20:40
    
new sudo rules will be used for every new logged user - so you need re login at least –  bluszcz Feb 27 '13 at 10:17
11  
'sudo service sudo restart' works :) –  Laice Jun 11 '13 at 2:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.