/etc/sudoers - sudo Konfigurationsdatei

# Anzahl der Minuten, bevor sudo erneut nach einem Kennwort fragt (Immer fragen=0)
Defaults timestamp_timeout = 5

Cmnd_Alias TOP=/usr/bin/top
Cmnd_Alias SHUTDOWN=/sbin/shutdown
Cmnd_Alias BASH=/bin/bash
User_Alias SHUTDOWN_USERS=thomasba,jonasm,lucasa

# user | hosts,auf denen nachfolgende def. ausgeführt werden dürfen |= |(user-context) | Befehlsliste #
SHUTDOWN_USERS ALL=(ALL) SHUTDOWN
%users         ALL=(ALL) NOPASSWD:TOP
%admins        ALL=(ALL) PASSWD: BASH, /bin/kill, NOPASSWD:TOP

Befehlseingabe

sudo /bin/bash

syslog

May 11 10:06:24 server001 sudo: thomasba : TTY=pts/1 ; PWD=/home/thomasba ; USER=root ; COMMAND=/bin/bash

examples from man page

# User alias specification
User_Alias     FULLTIMERS = millert, mikef, dowdy
User_Alias     PARTTIMERS = bostley, jwfox, crawl
User_Alias     WEBMASTERS = will, wendy, wim

# Runas alias specification
Runas_Alias    OP = root, operator
Runas_Alias    DB = oracle, sybase

# Host alias specification
Host_Alias     SPARC = bigtime, eclipse, moet, anchor :\
               SGI = grolsch, dandelion, black :\
               ALPHA = widget, thalamus, foobar :\
               HPPA = boa, nag, python
Host_Alias     CUNETS = 128.138.0.0/255.255.0.0
Host_Alias     CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias     SERVERS = master, mail, www, ns
Host_Alias     CDROM = orion, perseus, hercules

# Cmnd alias specification
Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
                       /usr/sbin/restore, /usr/sbin/rrestore
Cmnd_Alias     KILL = /usr/bin/kill
Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm
Cmnd_Alias     SHUTDOWN = /usr/sbin/shutdown
Cmnd_Alias     HALT = /usr/sbin/halt, /usr/sbin/fasthalt
Cmnd_Alias     REBOOT = /usr/sbin/reboot, /usr/sbin/fastboot
Cmnd_Alias     SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
                        /usr/local/bin/tcsh, /usr/bin/rsh, \
                        /usr/local/bin/zsh
Cmnd_Alias     SU = /usr/bin/su

# Override built in defaults
Defaults               syslog=auth
Defaults>root          !set_logname
Defaults:FULLTIMERS    !lecture
Defaults:millert       !authenticate
Defaults@SERVERS       log_year, logfile=/var/log/sudo.log

root           ALL = (ALL) ALL
%wheel         ALL = (ALL) ALL

# Full time sysadmins (millert, mikef, and dowdy) may run any command on
# any host without authenticating themselves.
FULLTIMERS     ALL = NOPASSWD: ALL

#Part time sysadmins (bostley, jwfox, and crawl) may run any command on
#any host but they must authenticate themselves first (since the entry
#lacks the NOPASSWD tag).
PARTTIMERS     ALL = ALL

#The user jack may run any command on the machines in the CSNETS alias
#(the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0).  Of
#those networks, only 128.138.204.0 has an explicit netmask (in CIDR
#notation) indicating it is a class C network.  For the other networks
#in CSNETS, the local machine's netmask will be used during matching.
jack           CSNETS = ALL

#The user lisa may run any command on any host in the CUNETS alias (the
#class B network 128.138.0.0).
lisa           CUNETS = ALL

#The operator user may run commands limited to simple maintenance.
#Here, those are commands related to backups, killing processes, the
#printing system, shutting down the system, and any commands in the
#directory /usr/oper/bin/.
operator       ALL = DUMPS, KILL, PRINTING, SHUTDOWN, HALT, REBOOT,\
                     /usr/oper/bin/

# The user joe may only su(1) to operator.
joe            ALL = /usr/bin/su operator


#The user pete is allowed to change anyone's password except for root on
#the HPPA machines.  Note that this assumes passwd(1) does not take mul-
#tiple usernames on the command line.
pete           HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root

#The user bob may run anything on the SPARC and SGI machines as any user
#listed in the OP Runas_Alias (root and operator).
bob            SPARC = (OP) ALL : SGI = (OP) ALL

#The user jim may run any command on machines in the biglab netgroup.
#Sudo knows that "biglab" is a netgroup due to the '+' prefix.
jim            +biglab = ALL

#Users in the secretaries netgroup need to help manage the printers as
#well as add and remove users, so they are allowed to run those commands
#on all machines.
+secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser

#The user fred can run commands as any user in the DB Runas_Alias (ora-
#cle or sybase) without giving a password.
fred           ALL = (DB) NOPASSWD: ALL


#On the ALPHA machines, user john may su to anyone except root but he is
#not allowed to give su(1) any flags.
john           ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*

#The user jen may run any command on any machine except for those in the
#SERVERS Host_Alias (master, mail, www and ns).
jen            ALL, !SERVERS = ALL

#For any machine in the SERVERS Host_Alias, jill may run any commands in
#the directory /usr/bin/ except for those commands belonging to the SU
#and SHELLS Cmnd_Aliases.
jill           SERVERS = /usr/bin/, !SU, !SHELLS


#The user steve may run any command in the directory /usr/local/op_com-
#mands/ but only as user operator.
steve          CSNETS = (operator) /usr/local/op_commands/


#On his personal workstation, valkyrie, matt needs to be able to kill
#hung processes.
matt           valkyrie = KILL

#On the host www, any user in the WEBMASTERS User_Alias (will, wendy,
#and wim), may run any command as user www (which owns the web pages) or
#simply su(1) to www.
WEBMASTERS     www = (www) ALL, (root) /usr/bin/su www

#Any user may mount or unmount a CD-ROM on the machines in the CDROM
#Host_Alias (orion, perseus, hercules) without entering a password.
#This is a bit tedious for users to type, so it is a prime candidate for
#encapsulating in a shell script.
ALL            CDROM = NOPASSWD: /sbin/umount /CDROM,\
                       /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM