GNU/Linux Desktop Survival Guide by Graham Williams
Desktop Survival Project Home Preface Advocacy History Distributions Installing GNU/Linux Basic Survival Wajig Applications AI, Machine Learning, Data Science Android - GNU/Linux Devices Audio Backup Booting CD Chinese ChRoot Clock Cloud Computing Command Line Databases DIA Directories Disks Emacs EcoSysL Email Evolution Files File Systems Firewalls Floppy Disks FreedomBox Fonts Ghemical Glade GNOME Graphics, Images, Photos Hardware Initialisations on Booting Installation Examples IOT Java KDE Kernels Keyboard Konqueror KVM Switch LaTeX Log System Login Magellan MATE Mathematics Memory Modems Mounting Devices MS/Windows Music MySQL Nautilus Networks NFS NT File System Oracle Packages Partitions Passwords PDF Power Management PPP Presentations Printing Python R Remote Desktops Rsync Samba Scanning Science Screens Security Sketch Spell SPlus Spruce Spreadsheet SSH SUDO Swap Teradata Data Warehouse Themes TV Unity USB Version Control Video Virtualization Voice over IP World Wide Web WebCam WordPress Web Sites Word Processing and Printing X XML Troubleshooting Index

CLICK HERE TO VISIT THE UPDATED SURVIVAL GUIDE

SUDO: Root Access

The sudo package allows a normal user to execute commands as root in a controlled manner.

Debian's sudo package has the password timeout set to 15 minutes. This means that when you first enter your password, as long as you don't wait more than 15 minutes between sudo commands, you won't have to enter it again. The password timeout can be immediately expired with sudo -k.

Debian's sudo is compiled with

  --with-exempt=sudo
  --with-secure-path="/usr/local/sbin:/usr/local/bin:/usr/sbin:...

As a consequence, the PATH of the user is ignored except if the user is in group sudo.

Adding users to the group sudo allows those users to execute sudo without a password but this is strongly discouraged.

Sudo allows a fairly fine grain of control. Note that inclusions (lists of specific commands/paths allowed, rather than rejected) is preferable. But be careful granting root access to commands with shell escapes.