Red Hat System Administration II · RH134

Chapter 13

Recovering Superuser Access

su vs. sudo · sudoers and visudo · Auditing · Locked-out recovery
CIS238RH — Mesa Community College
Configure and audit privileged access with su and sudo, and recover a system where superuser access has been lost entirely.

Key Commands

  • su -
  • sudo
  • visudo
  • sudo -l
  • root (UID 0) is exempt from most standard permission checks.
  • Two different situations:
  • an authorized administrator needs root temporarily, or
  • the system is locked out and nobody can authenticate as root.
Why It MattersDay to day, the work is controlling and auditing sudo. Losing root entirely is rarer, and Chapter 12 covered the fix.
susudo
RequiresThe TARGET user's passwordYOUR OWN password (by default)
ScopeOpens a full shell as another userRuns one command with elevated privileges, then returns
LoggingMinimalEvery invocation logged to /var/log/secure
GranularityAll-or-nothingCan be restricted to specific commands per user/group
# Switch to root, requires ROOT's password, starts a login shell
su -

# Run a single command as root, requires YOUR OWN password
sudo systemctl restart sshd

# Get an interactive root shell via sudo instead
sudo -i
Tipsudo ties every action to an individual and logs it. That matters most when several administrators share a system.
# ALWAYS edit sudo configuration with visudo — never a plain editor
sudo visudo

# Grant a specific user full sudo access
sarah  ALL=(ALL)  ALL

# Grant a user sudo access to only specific commands
miguel  ALL=(ALL)  /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd

# Allow a command WITHOUT prompting for a password
miguel  ALL=(ALL)  NOPASSWD: /usr/bin/systemctl status httpd

Rule format: who host=(run as) commands

# Prefer a dedicated file per admin/team over editing the main file
sudo visudo -f /etc/sudoers.d/miguel
Warning — Always Use visudovisudo locks the file and checks syntax before saving. A broken sudoers file saved from a plain editor can lock everyone out of sudo.
Notesudo skips files in /etc/sudoers.d/ whose names contain a dot or end in ~, so name them simply, like miguel.
# In /etc/sudoers, this line is often present (may need uncommenting):
%wheel  ALL=(ALL)  ALL

# Add a user to the wheel group to grant them full sudo access
sudo usermod -aG wheel sarah

# Confirm membership
groups sarah
NoteOn RHEL, the %wheel rule is active by default. Group membership scales better than individual entries; the user must log in again for it to take effect.
# Show what commands YOU are currently allowed to run with sudo
sudo -l

# Review the sudo activity log
sudo grep sudo /var/log/secure

# Or, if using the journal exclusively
journalctl _COMM=sudo
Tipsudo -l is the fastest way to confirm a sudoers change did what you intended.

No root password and no sudo access? Use the Chapter 12 boot-time procedure:

  • Interrupt GRUB and append rd.break to the linux line
  • mount -o remount,rw /sysroot, then chroot /sysroot
  • passwd root
  • touch /.autorelabel on SELinux systems
WarningThis needs physical or console access. It can't be done remotely over the network.

If a sudoers syntax error blocks sudo but root's password still works, you don't need the boot-time procedure.

  • Log in as root, or use su -, and fix the file with visudo.
  • Or edit it from rescue mode.
  • Prefer narrowly scoped sudo commands over broad grants
  • Use the wheel group for team-wide access
  • Always edit with visudo
  • Periodically review sudo -l and the audit logs
  • Minimize direct root logins in favor of individual sudo accountability
root
The superuser account (UID 0), largely exempt from permission checks
su
Switches to another user's full shell using that user's password
sudo
Runs one command with elevated privileges, using your own password
visudo
The safe, validating editor for sudoers configuration
wheel group
A group traditionally granted broad sudo access
/etc/sudoers.d/
Directory for per-user or per-team sudo configuration files
  1. Whose password does su require, and whose does sudo require?
  2. Why is sudo better for accountability than sharing root through su?
  3. Why must sudo configuration be edited with visudo?
  4. What is the advantage of granting access through the wheel group?
  5. Which command shows the sudo commands the current user may run?
  6. Root's password works, but a sudoers syntax error blocks sudo. Do you need the Chapter 12 boot recovery?
  7. What access does the boot-time password reset require that makes it unsuitable for remote fixes?