Sudo privileges limited to a specific group of users

Emmanuel FRANCOIS

2/4/24, 11:37 AM

I'm configuring our new Ubuntu 22.04 VPS to host our react app and REST API.
I followed this tuto that seems relatively advanced and complete :
https://gofoss.net/server-hardening-advanced/

I'm currently adjusting sudo access.
In this tuto, they write : "Privileged access should be limited to users of a specific group"
and provide steps to do it, as below:

Create a group called "mysudos":
sudo groupadd sudousers
Add your "myadmacc" admin user to this group:
sudo usermod -a -G mysudos myadmacc
Backup the "/etc/sudoers" configuration file:
sudo cp --archive /etc/sudoers /etc/sudoers-COPY-$(date +"%Y%m%d%H%M%S")
Add the following line to "/etc/sudoers" file:
%mysudos ALL=(ALL:ALL) ALL
Limit access to elevated privileges to the mysudos group:
sudo dpkg-statoverride --update --add root mysudos 4750 /bin/su
Check permissions:
ls -lh /bin/su

The terminal should display "mysudos".

However, the terminal displays:
-rwsr-x--- 1 root mysudos 55K Feb 21 2022 /bin/su

Additionaly, in "/etc/sudoers" file, i can see:

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "@include" directives:

@includedir /etc/sudoers.d
%mysudos ALL=(ALL:ALL) ALL

It seems that my new specific group "mysudos" has been correctly granted to sudo privileges, but "admin" and "sudo" privileges have not been limited.

Question 1: is it really good practice to create a specific group with sudo privileges ?

Question 2: if we create this specific group, souldn't we remove access to sudo privileges to existing groups ("admin", "sudo"), if the purpose of this is to limit sudo privileges to default admin groups? How to do it?

695

1 + 0

ubuntu

permissions

sudo

Score:0

Server

Mohammed Chaaraoui

2/4/24, 12:51 PM

Question 1: Yes, it is considered a good practice to create a specific group with sudo privileges, as it provides a more granular control over who has access to elevated privileges.

Question 2: Yes, if the purpose is to limit sudo privileges to only the new specific group, you would need to remove access to existing groups like "admin" and "sudo".

This can be done by commenting out or removing the corresponding lines in the "/etc/sudoers" file. For example, you can comment out the following lines:

Members of the admin group may gain root privileges

%admin ALL=(ALL) ALL

Allow members of group sudo to execute any command

%sudo ALL=(ALL:ALL) ALL

By doing this, only the new specific group "mysudos" will have access to sudo privileges.

+ 3

Emmanuel FRANCOIS

2/4/24, 1:34 PM

Many thanks for your quick answer! Should I also remove the previleges of "root" ?

Mohammed Chaaraoui

2/4/24, 1:44 PM

It is recommended to not remove the privileges of the "root" user The recommendation is to not remove the privileges of the "root" user as it is the most powerful user in the system and it is essential for the proper functioning of the system. Additionally, it's possible that something may happen to your group "mysudos" and having the "root" group available can be a fallback in case of any issues.

Emmanuel FRANCOIS

2/4/24, 6:26 PM

Indeed, it is a good idea to keep the root account priviliges in case of problems on my custom group. Thanks for your help.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Sudo privileges limited to a specific group of users

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.