path: root/sudoers.cat

sudoers(5)                 FILE FORMATS                sudoers(5)


NNNNAAAAMMMMEEEE
       sudoers - list of which users may execute what as root

DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN
       The _s_u_d_o_e_r_s file is composed of an optional host alias
       section, an optional command alias section and the user
       specification section.  All command or host aliases need
       to start with their respective keywords (ie: Host_Alias,
       User_Alias, Runas_Alias or Cmnd_Alias).  If there are
       multiple occurrences of a user, the union of the entries
       will be used.

       uuuusssseeeerrrr ssssppppeeeecccciiiiffffiiiiccccaaaattttiiiioooonnnn ffffoooorrrrmmmmaaaatttt::::


         user access_group [: access_group] ...

           access_group ::= host_type = [(runas_list)] [NOPASSWD:] [op]cmnd_type
                            [,[(user_list)] [NOPASSWD:] [op]cmnd_type] ...
              host_type ::= a lower-case hostname, netgroup, ip address,
                            network number, network number/netmask,
                            or host alias.
              runas_list ::= comma-separated list of users, groups,
                             netgroups or Runas_Aliases the user may run
                             commands as (default is root).
              cmnd_type ::= a command OR a command alias.
                     op ::= the logical "!" NOT operator.


       hhhhoooosssstttt aaaalllliiiiaaaassss sssseeeeccccttttiiiioooonnnn ffffoooorrrrmmmmaaaatttt::::


         Host_Alias HOSTALIAS = host-list

             Host_Alias ::= a keyword.
              HOSTALIAS ::= an upper-case alias name.
              host-list ::= a comma separated list of hosts, netgroups,
                            ip addresses, networks.


       uuuusssseeeerrrr aaaalllliiiiaaaassss sssseeeeccccttttiiiioooonnnn ffffoooorrrrmmmmaaaatttt::::


         User_Alias USERALIAS = user-list

             User_Alias ::= a keyword.
              USERALIAS ::= an upper-case alias name.
              user-list ::= a comma separated list of users, groups, netgroups.


       rrrruuuunnnnaaaassss aaaalllliiiiaaaassss sssseeeeccccttttiiiioooonnnn ffffoooorrrrmmmmaaaatttt::::


         Runas_Alias RUNASALIAS = runas-list



6/Feb/98                      1.5.8                             1





sudoers(5)                 FILE FORMATS                sudoers(5)


             Runas_Alias ::= a keyword.
              RUNASALIAS ::= an upper-case alias name.
              runas-list ::= a comma separated list of users, groups, netgroups.


       ccccoooommmmmmmmaaaannnndddd aaaalllliiiiaaaassss sssseeeeccccttttiiiioooonnnn ffffoooorrrrmmmmaaaatttt::::


         Cmnd_Alias CMNDALIAS = cmnd-list

             Cmnd_Alias ::= a keyword.
              CMNDALIAS ::= an upper-case alias name.
              cmnd-list ::= a comma separated list commands.


       ccccoooommmmmmmmaaaannnndddd ssssppppeeeecccciiiiffffiiiiccccaaaattttiiiioooonnnn::::


         path arg1 arg2 .. argn = command

                   path ::= a fully qualified pathname.
              arg[1..n] ::= optional command line arguments.


       wwwwiiiillllddddccccaaaarrrrddddssss ((((aaaakkkkaaaa mmmmeeeettttaaaa cccchhhhaaaarrrraaaacccctttteeeerrrrssss))))::::

       ssssuuuuddddoooo allows shell-style _w_i_l_d_c_a_r_d_s along with command
       arguments in the _s_u_d_o_e_r_s file.  Wildcard matching is done
       via the PPPPOOOOSSSSIIIIXXXX fnmatch(3) routine.

       *       Matches any set of zero or more characters.

       ?       Matches any single character.

       [...]   Matches any character in the specified range.

       [!...]  Matches any character nnnnooootttt in the specified range.

       \x      For any character "x", evaluates to "x".  This is
               used to escape special characters such as: "*",
               "?", "[", and "}".

       eeeexxxxcccceeeeppppttttiiiioooonnnnssss ttttoooo wwwwiiiillllddddccccaaaarrrrdddd rrrruuuulllleeeessss::::

       The following exceptions apply to the above rules:

       "       If the empty string "" is the only command line
               argument in the _s_u_d_o_e_r_s entry it means that
               command may take nnnnoooo arguments.

       ooootttthhhheeeerrrr ssssppppeeeecccciiiiaaaallll cccchhhhaaaarrrraaaacccctttteeeerrrrssss aaaannnndddd rrrreeeesssseeeerrrrvvvveeeedddd wwwwoooorrrrddddssss::::

       Text after a pound sign (####) is considered a comment.
       Words that begin with a percent sign (%%%%) are assumed to be



6/Feb/98                      1.5.8                             2





sudoers(5)                 FILE FORMATS                sudoers(5)


       UN*X groups (%staff refers to users in the group _s_t_a_f_f).
       Words that begin with a plus sign (++++) are assumed to be
       netgroups (++++ccccsssshhhhoooossssttttssss refers to the netgroup _c_s_h_o_s_t_s).  Long
       lines can be newline escaped with the backslash \\\\
       character.  The reserved word NNNNOOOOPPPPAAAASSSSSSSSWWWWDDDD indicates that a
       user need not enter a password for the command listed in
       that entry.

       The reserved alias _A_L_L can be used for both
       {Host,User,Cmnd}_Alias.  DDDDOOOO NNNNOOOOTTTT define an alias of _A_L_L, it
       will NNNNOOOOTTTT be used.  Note that _A_L_L implies the entire
       universe of hosts/users/commands.  You can subtract
       elements from the universe by using the syntax:
          user  host=ALL,!ALIAS1,!/etc/halt...  Note that the "!"
       notation only works in a user's command list.  You may not
       use it to subtract elements in a User_Alias, Host_Alias,
       Cmnd_Alias or user list.

       Commands may have optional command line arguments.  If
       they do, then the arguments in the _s_u_d_o_e_r_s file must
       exactly match those on the command line.  It is also
       possible to have a command's arguments span multiple lines
       as long as the line continuance character "\" is used.
       The following characters must be escaped with a "\" if
       used in command arguments: ",", ":", "=", "\".

EEEEXXXXAAAAMMMMPPPPLLLLEEEESSSS
           # Host alias specification
           Host_Alias  HUB=houdini:\
                       REMOTE=merlin,kodiakthorn,spirit
           Host_Alias  SERVERS=houdini,merlin,kodiakthorn,spirit
           Host_Alias  CUNETS=128.138.0.0/255.255.0.0
           Host_Alias  CSNETS=128.138.243.0,128.138.204.0,\
                              128.138.205.192

           # User alias specification
           User_Alias  FULLTIME=millert,dowdy,mikef
           User_Alias  PARTTIME=juola,mccreary,tor

           # Runas alias specification
           Runas_Alias OP=root,operator

           # Command alias specification
           Cmnd_Alias  LPCS=/usr/etc/lpc,/usr/ucb/lprm
           Cmnd_Alias  SHELLS=/bin/sh,/bin/csh,/bin/tcsh,/bin/ksh
           Cmnd_Alias  SU=/bin/su
           Cmnd_Alias  MISC=/bin/rm,/bin/cat:\
                       SHUTDOWN=/etc/halt,/etc/shutdown









6/Feb/98                      1.5.8                             3





sudoers(5)                 FILE FORMATS                sudoers(5)


           # User specification
           FULLTIME    ALL=(ALL) NOPASSWD: ALL
           %wheel      ALL=ALL
           PARTTIME    ALL=ALL,!SHELLS,!SU
           +interns    +openlabs=ALL,!SHELLS,!SU
           britt       REMOTE=SHUTDOWN:ALL=LPCS
           jimbo       CUNETS=/bin/su ?*,!/bin/su *root*
           nieusma     SERVERS=SHUTDOWN,/etc/reboot:\
                       HUB=ALL,!SHELLS
           jill        houdini=/etc/shutdown -[hr] now,MISC
           markm       HUB=ALL,!MISC,!/etc/shutdown,!/etc/halt
           davehieb    merlin=(OP) ALL:SERVERS=/etc/halt:\
                       kodiakthorn=NOPASSWD: ALL
           steve       CSNETS=(operator) /usr/op_commands/


       HHHHoooosssstttt AAAAlllliiiiaaaassss ssssppppeeeecccciiiiffffiiiiccccaaaattttiiiioooonnnnssss::::

       The are four _h_o_s_t _a_l_i_a_s_e_s.  The first actually contains
       two _a_l_i_a_s_e_s.  It sets HUB to be houdini and REMOTE to the
       three machines merlin, kodiakthorn and spirit.  Similarly,
       SERVERS is set to the machines houdini, merlin,
       kodiakthorn and spirit.  The CSNETS alias will match any
       host on the 128.138.243.0, 128.138.204.0, or
       128.138.205.192 nets.  The CUNETS alias will match any
       host on the 128.138.0.0 (class B) network.  Note that
       these are nnnneeeettttwwwwoooorrrrkkkk addresses, not ip addresses.  Unless an
       explicate netmask is given, the local _n_e_t_m_a_s_k is used to
       determine whether or not the current host belongs to a
       network.

       UUUUsssseeeerrrr AAAAlllliiiiaaaassss ssssppppeeeecccciiiiffffiiiiccccaaaattttiiiioooonnnnssss::::

       The two _u_s_e_r _a_l_i_a_s_e_s simply groups the FULLTIME and
       PARTTIME folks into two separate aliases.

       CCCCoooommmmmmmmaaaannnndddd aaaalllliiiiaaaassss ssssppppeeeecccciiiiffffiiiiccccaaaattttiiiioooonnnnssss::::

       Command aliases are lists of commands with or without
       associated command line arguments.  The entries above
       should be self-explanatory.

       UUUUsssseeeerrrr ssssppppeeeecccciiiiffffiiiiccccaaaattttiiiioooonnnnssss::::


       FULLTIME        Full-time sysadmins in the FULLTIME alias
                       may run any command on any host as any
                       user without a password.

       %wheel          Any user in the UN*X group wheel may run
                       any command on any host.

       PARTTIME        Part-time sysadmins in the PARTTIME alias
                       may run any command except those in the



6/Feb/98                      1.5.8                             4





sudoers(5)                 FILE FORMATS                sudoers(5)


                       SHELLS and SU aliases on any host.

       +interns        Any user in the netgroup interns may run
                       any command except those in the SHELLS and
                       SU aliases on any host that is in the
                       openlabs netgroup.

       britt           The user britt may run commands in the
                       SHUTDOWN alias on the REMOTE machines and
                       commands in the LPCS alias on any machine.

       jimbo           The user jimbo may su to any user save
                       root on the machines on CUNETS (which is
                       explicately listed as a class B network).

       nieusma         The user nieusma may run commands in the
                       SHUTDOWN alias as well as _/_e_t_c_/_r_e_b_o_o_t on
                       the SERVER machines and any command except
                       those in the SHELLS alias on the HUB
                       machines.

       jill            The user jill may run /etc/shutdown -h now
                       or /etc/shutdown -r now as well as the
                       commands in the MISC alias on houdini.

       markm           The user markm may run any command on the
                       HUB machines except _/_e_t_c_/_s_h_u_t_d_o_w_n,
                       _/_e_t_c_/_h_a_l_t, and commands listed in the MISC
                       alias.

       davehieb        The user davehieb may run any command on
                       merlin as any user in the Runas_Alias OP
                       (ie: root or operator).  He may also run
                       _/_e_t_c_/_h_a_l_t on the SERVERS and any command
                       on kodiakthorn (no password required on
                       kodiakthorn).

       steve           The user steve may run any command in the
                       _/_u_s_r_/_o_p___c_o_m_m_a_n_d_s_/ directory as user
                       operator on the machines on CSNETS.

CCCCAAAAVVVVEEEEAAAATTTTSSSS
       The _s_u_d_o_e_r_s file should aaaallllwwwwaaaayyyyssss be edited by the vvvviiiissssuuuuddddoooo
       command which locks the file and does grammatical
       checking. It is imperative that the _s_u_d_o_e_r_s be free of
       syntax errors since sudo will not run with a syntactically
       incorrect _s_u_d_o_e_r_s file.

FFFFIIIILLLLEEEESSSS
        /etc/sudoers           file of authorized users.
        /etc/netgroup          list of network groups.






6/Feb/98                      1.5.8                             5





sudoers(5)                 FILE FORMATS                sudoers(5)


SSSSEEEEEEEE AAAALLLLSSSSOOOO
       _s_u_d_o(8), _v_i_s_u_d_o(8), _s_u(1), _f_n_m_a_t_c_h(3).























































6/Feb/98                      1.5.8                             6