17

I added a user named "admin" to my Ubuntu 14.04LTS server, using adduser.

I'm used to having to add a user to the /etc/sudoers file when adding a new user that needs sudo privileges, but this time I didn't. It doesn't appear the 'admin' user existed before I created it, based on the output in the shell. Why did this work this way?

1
  • Instead of manually editing the sudoers file, add them to the admin group.
    – Kaz Wolfe
    Jan 17 '15 at 19:37
30

By default adduser adds every new user to a group with the same name as the user's (the group is created if it doesn't already exists). So if you create a user called admin it will be added to the group admin.

/etc/sudoers contains the line

%admin ALL=(ALL) ALL

which means that all members of the group admin are allowed to use sudo - and that's true for your admin user, too.

8
  • 8
    This falls inside the definition of "bug" or "security problem" in my view. Why should there be a magic sequence of letter that gives you superpowers if you use it as your username? Jan 17 '15 at 12:58
  • 1
    @FedericoPoloni agree with you, although someone trying to exploit this would have to call adduser, which would mean he already has admin privileges... Still, worth adding a bug report I would think
    – nico
    Jan 17 '15 at 14:29
  • 7
    @FedericoPoloni Bug, not at all. The system adds users to their own group with the same name. Joe goes into a group named Joe. admin happens to go into a group named admin. But, admin is a system group. It's the group by default allowed to use sudo. Also, you can specify groups, so the admin user doesn't go into the admin group. Finally, it's a security problem to have a user named admin. I've had SSH brute-force attacks against me relying on my using the username admin.
    – Kaz Wolfe
    Jan 17 '15 at 19:37
  • 3
    @Whaaaaaat, for some reason, seeing that username at the end of your posts makes me question everything you say :)
    – trpt4him
    Jan 19 '15 at 0:58
  • 5
    I think that given the policy of one user - one group, the expected behavior (at least, for me) is to bail out with an error if the group name exists (as it does if the user name exists). I vote for the bug, or at least unexpected behavior.
    – Rmano
    Jan 20 '15 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.