Purpose of Host_alias in SUDO

[jkumar]

Hi ,

Can anyone explain whats the use of host_alias in sudoers file.

For example :

cmd_alias = command specified in this cmd_alias this commands will have sudo access
user_alias = users mentioned in this will have sudo access
Host_alias = ???

[Steven E. Protter]

Shalom,

This usually simply refers to the local system name.

It prevents remote users from using sudo functionality.

SEP

[Matti_Kurkela]

The idea is that if you wish, you can keep all sudo settings in one centralized sudoers file, which you can then distribute to all hosts on your site using any method you like (rdist, rsync, NFS or whatever).

If you have site-wide Unix accounts using NIS or LDAP and a centrally-maintained sudoers file, it's easy to change group memberships and sudo permissions whenever users move from one project to another.

If you have to enforce a strict security policy (maybe because of SOX, HIPPA, some other law or simply company policy), this kind of powerful centralized privilege management can help a lot.

MK

[jkumar]

Hello MK,

For each server we have saperate SUDO file ,In which we need to insert the IDs and commands ,Will it possible to configure the sudo file as centralized like NIS ??

[Matti_Kurkela]

If you have a mechanism that can take one file from one host and transfer/make it available to all other hosts with proper permissions, yes. _Any_ such mechanism will do: you can use whatever is acceptable for such tasks by your site policy.

If you use hostnames and/or Host_alias lines in your sudoers definitions, those definitions will take effect only when that sudoers file is used on the named host(s).

If your sudoers file says, for example:

Host_Alias SANDBOX = devhost1, devhost2
User_Alias DEVELOPER = user1, user2

DEVELOPER SANDBOX = (root) /usr/local/bin/tcpdump

it means this definition takes effect only on machines listed in the SANDBOX alias, i.e. devhost1 and devhost2. On all other hosts, this definition is *ignored* if it exists in their sudoers file.

(The idea behind this sudo definition is to allow developers run tcpdump as root to debug their network applications on development hosts *only*: it is assumed that running tcpdump on production hosts requires special permission or is not done by the developers. If a new development box is added, you only need to add its name to the Host_Alias line; if developers change, you just edit the User_Alias line.)

It's your task to figure out a good way to copy the sudoers file from one central location (chosen by you) to all the hosts that need it.

For a small-scale setup, I might use scripted rdist or rsync over SSH (with public key authentication to allow automating it). This could be run manually as needed, or set up as a cron job.

In a large enterprise, there might be existing central control systems, like HP OpenView, Control-M or whatever. If one of these can be configured to keep the sudoers files in each host synchronized to one master copy, that's one valid way to solve this problem.

MK

[jkumar]

Thx a lot Now i got it.

[jkumar]

Thx