Ubuntu – Why is usermod -a -G sudo username not working

groupssudo

During OS installation, I created only one account. Let's call it howdy. I thought it would have sudo privileges but I was wrong.

I scoured the internet and this forum to find out how to add howdy to the sudoers' list. I was under the impression that usermod -a -G sudo username would work. I opened a root terminal and issued the command. I closed it.

Next I opened a normal terminal and issued the following command: sudo gedit /etc/openvpn/update-resolv-conf

The following are the error messages:

howdy@wendy:~$ sudo gedit /etc/openvpn/update-resolv-conf
sudo: unable to resolve host wendy
[sudo] password for howdy: 
howdy is not in the sudoers file.  This incident will be reported.
[sudo] password for howdy:

Furthermore I discovered that my root password has changed to the password for howdy. This is odd.

So when I opened a root terminal I now had to enter the password for howdy (the original root password did not work) and issued the command visudo and scrolled down to the phrase # Allow members of group sudo to execute any command My account called howdy is not on it.

I need help with the following:

Undo the changes brought about by usermod -a -G sudo username, especially to revert the root password to the original password I entered during OS installation. I don't know what the parameters -a and -G do.
Show me how to add my account called howdy to the sudoers' list.

Best Answer

This should help you. -a appends to the group and should only be used with -G, which is the groups to append the user. To answer your question fully, to add someone to the sudoers group and to reset the root password:

su
passwd root
Enter new Unix password:
Confirm new Unix password:

Then:

usermod -a -G sudo howdy

Once this is done, you will need to restart in order for the new changes (adding howdy to the sudo group) to take effect.

ed1

So I might be creating security issues with the !env_reset. I'll keep updating.

Ubuntu – Block a command from sudo user

According to sudoers manual:

   It is generally not effective to "subtract" commands from ALL using the
   ’!’ operator.  A user can trivially circumvent this by copying the
   desired command to a different name and then executing that.  For
   example:

       bill        ALL = ALL, !SU, !SHELLS

   Doesn’t really prevent bill from running the commands listed in SU or
   SHELLS since he can simply copy those commands to a different name, or
   use a shell escape from an editor or other program.  Therefore, these
   kind of restrictions should be considered advisory at best (and
   reinforced by policy).

This is why your sudoers policy doesn't work.

If you would like to prevent user to gain root permission and change its password, try this procedure:

Assuming your sudoers contains this directive:

 root    ALL=(ALL:ALL) ALL
 %sudo   ALL=(ALL:ALL) ALL

Assuming your user name is foo, his groups are foo and sudo. groups command output is:
```
foo sudo
```
Remove user foo from sudo group: gpasswd -d foo sudo after this, user foo can not run any command with sudo.
Edit sudoers file. Use this command:
```
sudo visudo -f /etc/sudoers.d/foo
```
Define user foo permission, for example:
```
foo ALL=/usr/bin, !/usr/bin/passwd, !/usr/bin/su
```
This means that user foo may run any commands in the directory /usr/bin/ except passwd and su command. Note: If the user foo wants to change his password, can run passwd command without sudo.
Another example of user foo permission:
```
foo ALL =/usr/bin, /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
```
This means that user foo may run any commands in the directory /usr/bin/ and is allowed to change anyone’s password except for root on ALL machines.

You can define groups of command by define Cmnd_Aliases and create "levels of permissions". You can found useful examples in EXAMPLE section of sudoers manual, and here is a useful link about how to use sudoers.

Best Answer

Related Solutions

Ubuntu – I broke Sudo after an upgrade from 9 to 12.04.1

ed1

Ubuntu – Block a command from sudo user

Related Question