Please enable JavaScript.
Coggle requires JavaScript to display documents.
🔐 12 Linux Enterprise Sudo - Least Privilege Access Control - Coggle…
🔐 12 Linux Enterprise Sudo - Least Privilege Access Control
1️⃣ Introduction to Sudo
📌 What is Sudo?
Sudo = Super User DO
Purpose
Allow normal users to execute specific privileged commands
Execute commands with elevated permissions
Avoid giving users direct root login access
Enterprise Goal
Security
Accountability
Auditing
Least Privilege Access
📌 Why Sudo is Required in Enterprise
Without Sudo
Users need root password
No command tracking
High security risk
Difficult accountability
With Sudo
Users use their own accounts
Temporary privilege elevation
Every command is logged
Access can be controlled
2️⃣ Principle of Least Privilege (PoLP)
📌 Definition
Give users only the minimum permissions required
No unnecessary administrative access
📌 Example
Bad Security
Developer gets full root access
sudo ALL=(ALL) ALL
Good Security
Developer only restart application
sudo systemctl restart myapp
📌 Enterprise Benefits
Reduce insider threats
Reduce accidental damage
Limit malware impact
Improve compliance
3️⃣ Sudo Architecture in Linux
📁 Important Sudo Files
/etc/sudoers
Main sudo configuration file
Controls user privileges
Must edit using visudo
/etc/sudoers.d/
Directory for custom sudo policies
Enterprise recommended method
Separate files for teams
/var/log/auth.log
Ubuntu/Debian sudo logs
/var/log/secure
RHEL/CentOS sudo logs
4️⃣ visudo Command
📌 What is visudo?
Safe editor for sudo configuration
Command
sudo visudo
Why use visudo?
Checks syntax errors
Prevents broken sudo configuration
Locks file during editing
Edit separate policy file
sudo visudo -f /etc/sudoers.d/admin_team
5️⃣ Sudoers File Syntax
Format
USER HOST=(RUN_AS_USER) COMMANDS
Example
bilal ALL=(ALL) ALL
Breaking Down Each Field
👤 USER
Who receives permission
Example
bilal
ahmed
admin_group
🌐 HOST
Where permission applies
Example
ALL
All hosts
server01
Only server01
👑 RUN AS USER
Which user can execute commands as
Example
root
Execute as root
ALL
Execute as any user
⚙ COMMANDS
Which commands are allowed
Example
/usr/bin/systemctl
/usr/bin/journalctl
6️⃣ Understanding ALL Keyword
ALL means no restriction
First ALL
Host restriction
Example
bilal ALL=(root) ALL
Meaning
bilal can use sudo on any server
Second ALL
Run as user restriction
Example
bilal ALL=(ALL) ALL
Meaning
bilal can become any user
root
mysql
nginx
postgres
Third ALL
Command restriction
Example
bilal ALL=(root) ALL
Meaning
All commands allowed
7️⃣ User Based Sudo Access
Full Administrative User
Example
bilal ALL=(ALL) ALL
Permission
Complete root administration
Limited User
Example
backupuser ALL=(root) /usr/bin/rsync
Allowed
Backup operations only
8️⃣ Group Based Sudo Access
Why Groups?
Easier enterprise management
Manage many users together
Example Group
Linux Administrators
Create Group
sudo groupadd linux_admins
Add User
sudo usermod -aG linux_admins bilal
Sudo Rule
%linux_admins ALL=(ALL) ALL
Meaning
All members get sudo access
9️⃣ Command Restricted Sudo
Full Root Access
user ALL=(ALL) ALL
Restricted Example
user ALL=(root) /usr/bin/systemctl
Allowed
sudo systemctl restart nginx
Not Allowed
sudo useradd test
🔟 Multiple Command Permissions
Example
bilal ALL=(root) /usr/bin/systemctl,\
/usr/bin/journalctl,\
/usr/bin/tail
Purpose
Allow required administration only
1️⃣1️⃣ NOPASSWD Sudo
Definition
Run sudo commands without password
Example
bilal ALL=(ALL) NOPASSWD: ALL
Enterprise Usage
Automation servers
Ansible
CI/CD pipelines
Security Risk
Dangerous for human users
1️⃣2️⃣ Sudo Command Aliases
Purpose
Create reusable permission groups
User Alias
User_Alias ADMINS = bilal, ahmed
Command Alias
Cmnd_Alias SERVICES = /usr/bin/systemctl
Apply Rule
ADMINS ALL=(root) SERVICES
1️⃣3️⃣ Enterprise Role Based Sudo Model
👨💻 Linux Administrators
Permission
Full server management
Example
%linux_admins ALL=(ALL) ALL
🔐 SOC Analysts
Permission
Read security logs only
Commands
journalctl
tail
grep
👨💻 Developers
Permission
Restart applications
Example
systemctl restart application
💾 Backup Team
Permission
rsync
backup scripts
1️⃣4️⃣ Enterprise Sudo Directory Structure
/etc
sudoers
sudoers.d
linux_admins
developers
backup_team
soc_team
1️⃣5️⃣ Example Enterprise Configuration
File
/etc/sudoers.d/linux_admins
Content
%linux_admins ALL=(ALL) ALL
File
/etc/sudoers.d/developers
Content
%developers ALL=(root) /usr/bin/systemctl
File
/etc/sudoers.d/soc
Content
%soc ALL=(root) /usr/bin/journalctl
1️⃣6️⃣ Checking Sudo Permissions
Check Current User
sudo -l
Check Another User
sudo -l -U username
1️⃣7️⃣ Sudo Logging and Auditing
Logs
Ubuntu
/var/log/auth.log
RHEL
/var/log/secure
Audit Information
User name
Command executed
Time
Target user
1️⃣8️⃣ Sudo Security Best Practices
✅ Never allow unnecessary ALL
✅ Disable direct root login
✅ Use groups instead of individual users
✅ Use /etc/sudoers.d/
✅ Always edit with visudo
✅ Review sudo permissions regularly
✅ Remove unused accounts
✅ Enable logging
1️⃣9️⃣ Enterprise Workflow
Step 1
Create user
Step 2
Create role group
Step 3
Add user to group
Step 4
Create sudo policy
Step 5
Validate with visudo
Step 6
Test sudo access
Step 7
Monitor logs
2️⃣0️⃣ Complete Enterprise Example
Requirement
Linux Admin Team
Full access
Database Team
Database commands only
Developers
Application restart only
SOC
Log investigation only
Implementation
Groups
linux_admins
database_admins
developers
soc_team
Sudo Policies
/etc/sudoers.d/linux_admins
%linux_admins ALL=(ALL) ALL
/etc/sudoers.d/developers
%developers ALL=(root) /usr/bin/systemctl restart app
/etc/sudoers.d/soc_team
%soc_team ALL=(root) /usr/bin/journalctl
🎯 Final Enterprise Concept
Sudo is not about giving root access
Sudo is about controlled privilege elevation
Enterprise Security Model
Identity
Who is the user?
Authentication
Verify user
Authorization
What can user do?
Least Privilege
Minimum required access
Auditing
Record every action