how do I enable sudo?

[Gregg Dinse]

On 27 Oct 2006, at 11:11 AM, Dave Schroeder wrote:

> On Oct 27, 2006, at 9:55 AM, Gregg Dinse wrote:
>
>> Hi,
>>
>> For years my main account was an admin account and I could use  
>> sudo.  A few months ago, I decided to try to be a little more  
>> secure.  I created a special admin account and then I made my main  
>> account an ordinary user (i.e. non-admin) account.  I just tried  
>> to use sudo today (from my ordinary user account) and realized  
>> that I could not do it.
>>
>> Can sudo be executed from an ordinary user account?  If so, how do  
>> I do it?
>>
>> When I try to use sudo, it asks for my password (as expected), but  
>> after I provide the password, it says I am not in the sudoers  
>> file.  If it's possible, how do I add my ordinary user account  
>> name to the sudoers file?
>
> First, you should learn about how sudo works.
>
> man sudo
> man sudoers
>
> If you give your ordinary user the ability to use sudo, you're  
> reversing a lot of whatever security you think you're gaining by  
> making your primary user a non-admin user (to others: yes, yes, I  
> know...they still won't be able to do "graphical" admin things  
> without authentication).
>
> The way Mac OS X's sudoers file is set up by default is that anyone  
> in the admin group (i.e., who is an administrator) is able to use  
> sudo:
>
> # User privilege specification
> root    ALL=(ALL) ALL
> %admin  ALL=(ALL) ALL
>
> If you're not in the admin group, no sudo.
>
> So, you can certainly read the docs on how to add your individual  
> user to the sudoers file. sudo is also granular enough that you can  
> give yourself permission to only do the *specific things* (e.g.,  
> specific command line tools you wish to use) with sudo that you  
> wish to allow. That would be a better model.
>
> If you just add your non-admin account completely to sudoers, it  
> still has the power to essentially completely become root. This  
> means that if you were to come into contact with a malicious script  
> that you might be trying to protect yourself from, it could still  
> (for example) wait until the next time you used sudo, then become  
> root by being able to execute any command, since it would very  
> likely make the assumption that you're an admin user. However, if  
> you limited it to only the commands you need to use, the likelihood  
> that a malicious script such as that would be able to do damage is  
> much lower.
>
> - Dave

Hi Dave,

Thanks for the informative response.  I did not realize that I might  
be defeating much of the supposed increased security that I was  
trying to implement.

As you already noted in a subsequent response, Don Carlile suggested  
an approach that seems to work, and I think you said it was more  
secure than what I was trying to do.  If I simply "su" to my admin  
account, then I can run "sudo" from there.  This is not something I  
am likely to do very often, and I assume that this is at least a  
little more secure than having my main account be an admin account.

Thanks for your help,

Gregg