Page tree
Skip to end of metadata
Go to start of metadata

Ubuntu and Debian introduced the sudoers.d directory (not sure when, put year here) and this is the approach documented on the BonsaiFramework.

The Ubuntu approach ensures that system upgrades will not overwrite your changes.

For historical reasons, here is the original approach and may still be relevant when using other Linux distributions,

Older Standard

Use account names associated with a user. For this example, I will be designating adminstrative users under the staff group. To see the list of groups available to you use the command, cat /etc/group.

These steps are assuming that you are logged in with the initial Ubuntu user which as sudo access. If you are using root instead, then you do not need to prefix any command with sudo.

The staff group by default does not normally have sudo access. To grant sudo access to the staff group,

sudo visudo

visudo launches your default editor to a special file. Add the following to the bottom of the file,

# Members of the staff group may gain root privileges
%staff ALL=(ALL) ALL

Additional Background to the Ubuntu Approach

From the the sudoers man pages,

#includedir /etc/sudoers.d
sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing
problems with package manager or editor temporary/backup files.  Files are parsed in sorted lexical order.  That is,
/etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second.  Be aware that because the sorting is lexical, not
numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second.  Using a consistent number of leading
zeroes in the file names can be used to avoid such problems.
Note that unlike files included via #include, visudo will not edit the files in a #includedir directory unless one of them
contains a syntax error.  It is still possible to run visudo with the -f flag to edit the files directly. 
  • No labels