How To Add and Delete Users on a CentOS 7 Server

I get this when I try to use sudo with the created user :(

sudo: effective uid is not 0, is sudo installed setuid root?

I can see the user when I run sudo lid -g wheel and it has UID=1000

Thank you ! this was very helpful to resolve the issue that I had

This guide got me 90% of the way to adding a user with sudo privileges on the default centOS 6.6 install. I know the article is for centOS 7, but all I had to do to get my created user sudo access was:

visudo
...
## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL <--- UNCOMMENT THIS LINE

Tiny nit-pick, but on CentOS systems adduser is just a symlink to useradd:

# file $(which adduser)
/sbin/adduser: symbolic link to `useradd'

And various Debian-based distros have a custom script for adduser which behaves entirely differently to useradd:

# file $(which adduser)
/usr/sbin/adduser: a /usr/bin/perl script, ASCII text executable

So I always try and use useradd to keep things as consistent as possible, does anybody else find the same thing?

Here is some info on sudoers and how to use it, why to use it and so on.

The sudoers file in Linux defines which users and groups have sudo privileges, specifying who can execute commands as the root user or another specified user. This file allows system administrators to control permissions and can be configured to include specific settings like passwordless sudo access and custom rules for commands.

Here’s a breakdown of the sudoers file, its usage, and customization options:

1. The Basics of sudoers Access

The main sudoers file is located at /etc/sudoers, and it’s edited using the visudo command:

visudo

Using visudo is recommended because it locks the file during editing and performs a syntax check, preventing configuration errors that could block sudo access.

In sudoers, each line defines rules with this structure:

<user_or_group> <host> = (<run_as_user>) <command>

• <user_or_group>: Specifies the user (like username) or group (%groupname) to give sudo access.
• <host>: Defines the host on which this rule applies (usually ALL).
• <run_as_user>: Specifies the user as whom commands will run (often ALL to allow any user).
• <command>: Defines allowed commands. Setting this to ALL allows any command.

Example

To grant sudo access to a user admin, the rule would look like:

admin ALL=(ALL) ALL

This allows admin to run any command as any user on any host.

2. Using sudoers.d for Modular Configuration

Rather than editing the main /etc/sudoers file directly, you can place configuration files in the /etc/sudoers.d directory. Files in this directory are loaded along with /etc/sudoers, which makes managing permissions easier and safer.

1. Create a File in /etc/sudoers.d:

sudo visudo -f /etc/sudoers.d/username

2. Add Rules in the New File:

username ALL=(ALL) ALL

Each file in /etc/sudoers.d should have only the specific rules you want to add or override. This approach is useful in multi-user or automated environments where different teams may need distinct permissions.

3. Granting Passwordless sudo Access

By default, users are prompted for a password when running a command with sudo. To allow passwordless sudo, add the NOPASSWD directive:

username ALL=(ALL) NOPASSWD: ALL

This allows username to execute any command without entering a password.

Limiting Passwordless Commands

You can restrict passwordless access to specific commands. For example, if you want username to restart the web server without a password:

username ALL=(ALL) NOPASSWD: /usr/sbin/service apache2 restart

This rule only applies to /usr/sbin/service apache2 restart and still requires a password for other commands.

4. Common sudoers Examples

Here are a few configurations you might find useful:

• Granting Group Access: Use %groupname to apply rules to all users in a group. For example, to allow users in the developers group to run any command:

%developers ALL=(ALL) ALL

Limiting Commands for Security: Restrict access to specific administrative commands without allowing unrestricted sudo access:

username ALL=(ALL) /bin/systemctl restart nginx, /bin/systemctl restart apache2

Combining NOPASSWD with Limited Commands: For a safer setup, allow passwordless access only to a few commands:

username ALL=(ALL) NOPASSWD: /usr/sbin/reboot, /usr/sbin/poweroff

5. Testing and Verifying sudoers Configuration

After adding or modifying sudoers rules, it’s a good idea to test them by switching to the user and running a test command:

sudo -l

The sudo -l command lists available sudo privileges for the current user, helping verify that the configuration works as expected.

By using sudoers.d for modular rule management, NOPASSWD for controlled passwordless access, and group-based permissions, you can securely configure sudo privileges tailored to each user or team’s needs.