How To Add User to Sudoers & Add User to Sudo Group on CentOS 7

If you're new to CentOS 7, one of the first things you'll want to do is learn how to add users to the sudoers file and the sudo group. This will give them elevated privileges and allow them to run commands with root-level permissions. In this article, we'll walk you through the process step-by-step.

What is Sudo?

Before we get started, let's talk about what sudo is and why it's important. Sudo stands for "superuser do" and is a command that allows users to perform tasks with administrative permissions. By default, only the root user has these permissions on CentOS 7, but using sudo, we can grant certain users the ability to perform administrative tasks as well.

What is the Sudoers File?

The sudoers file is a configuration file that controls who has access to sudo and what they're allowed to do. It's located at /etc/sudoers and is edited using the visudo command. When editing the sudoers file, it's important to be careful and make sure you don't make any mistakes. A typo or syntax error can render the file unusable, which could cause serious problems.

Adding a User to the Sudo Group

The easiest way to give a user sudo permissions is by adding them to the sudo group. Here's how to do it −

Step 1: Log in as Root

To add a user to the sudo group, you'll need to be logged in as the root user. If you're not already logged in as root, you can switch to the root user by typing "su" followed by your root password.

Step 2: Add the User to the Sudo Group

To add a user to the sudo group, you'll use the usermod command. Here's the syntax −

usermod -aG sudo username

Replace "username" with the name of the user you want to add to the sudo group. The "-a" flag tells usermod to append the user to the group instead of replacing any existing group memberships.

Here's an Example

usermod -aG sudo john

This command adds the user "john" to the sudo group.

Step 3: Verify the User's Sudo Access

To verify that the user has sudo access, you can switch to their account and try running a command with sudo. For example, you could try running the "whoami" command with sudo −

sudo whoami

This should prompt you for your password, and then return "root" if everything is working correctly.

Adding a User to the Sudoers File

If you don't want to add a user to the sudo group, you can also add them to the sudoers file directly. Here's how to do it −

Step 1: Log in as Root

As with adding a user to the sudo group, you'll need to be logged in as root to edit the sudoers file.

Step 2: Edit the Sudoers File

To edit the sudoers file, you'll use the visudo command. This command opens the sudoers file in a text editor and checks the syntax for errors before saving the changes. To add a user to the sudoers file, you'll need to add a line in the following format −

username  ALL=(ALL)  ALL

Replace "username" with the name of the user you want to add. This line grants the user permission to run any command with sudo.

Here's an Example

john  ALL=(ALL)  ALL

This line grants the user "john" permission to run any command with sudo.

Step 3: Save the Changes

When you're done editing the sudoers file, save your changes and exit the text editor. If you're using the nano editor, you can save changes by pressing Ctrl+O, and then exit by pressing Ctrl+X. If you're using vim, you can save changes by typing ":wq" and pressing Enter.

Step 4: Verify the User's Sudo Access

To verify that the user has sudo access, switch to their account and try running a command with sudo. For example, you could try running the "whoami" command with sudo −

sudo whoami

This should prompt you for your password, and then return "root" if everything is working correctly.

Troubleshooting

If you're having trouble adding a user to the sudo group or sudoers file, here are a few things to check −

Make sure you're Logged in as Root

You need to be logged in as the root user to make changes to the sudoers file or add a user to the sudo group. If you're not logged in as root, switch to the root user by typing "su" followed by your root password.

Check the Syntax of the Sudoers File

The sudoers file has a very strict syntax, and even a small mistake can cause it to become unusable. Use the visudo command to check the syntax of the file for errors.

Check the Permissions of the Sudoers File

The sudoers file should have the following permissions: -r--r----- (440). If the permissions are different, you can set them using the following command −

chmod 440 /etc/sudoers

Some additional tips and best practices to keep in mind when adding users to the sudoers file or the sudo group on CentOS 7 include −

Limit the Number of Users with Sudo Access

The more users with sudo access, the greater the risk of someone making a mistake or intentionally causing harm to the system. Only grant sudo access to users who truly need it for their job responsibilities.

Use Groups to Manage Sudo Access

Instead of adding individual users to the sudoers file, consider creating groups with specific sudo permissions and adding users to those groups. This makes it easier to manage sudo access for multiple users and reduces the risk of making mistakes when editing the sudoers file.

Use the "NOPASSWD" Option with Caution

The "NOPASSWD" option allows users to run sudo commands without entering a password, which can be convenient for frequently used commands. However, this can also be a security risk if an unauthorized user gains access to the user's account or if the system is compromised. Only use the "NOPASSWD" option for commands that are safe to run without a password.

Audit Sudo Access

Keep track of when and how often users are using sudo commands by enabling sudo access logging. This can help you identify potential security issues and audit compliance with company policies.

Another important aspect to consider when adding users to the sudoers file or the sudo group is to ensure that the user's password is strong and not easily guessable. Weak passwords can be a major security risk, as they can be easily guessed or cracked, allowing unauthorized access to the system. Encourage users to use strong, unique passwords and consider using a password manager to generate and store complex passwords.

It's also a good practice to periodically review the users who have sudo access and make sure that their access is still necessary. Users who no longer require sudo access should be removed from the sudo group or the sudoers file to reduce the risk of unauthorized access to the system.

Finally, it's important to keep the CentOS 7 system up-to-date with the latest security patches and updates. Vulnerabilities can be discovered in the sudo software itself, and installing the latest updates can help prevent these vulnerabilities from being exploited.

Conclusion

Adding a user to the sudoers file or the sudo group is an important step in securing your CentOS 7 server. By granting certain users administrative permissions, you can delegate tasks and reduce the likelihood of mistakes or accidents caused by granting full root access to everyone. Just be sure to use caution when making changes to the sudoers file and double-check your syntax before saving.