Can someone explain what is `<user> ALL=(ALL) NOPASSWD:ALL` does in sudoers file?

I know that that line above allows <user> to run sudo command without having to type in the password. But what does the syntax actually mean? If you can link to an article then that would be fine too. Thanks

Nabeel Parkar

Posted 2019-10-25T06:56:20.127

Reputation: 45

Answers

From man sudoers

By default, sudo requires that a user authenticate him or herself before running a command. This behavior can be modified via the NOPASSWD tag

So users or groups are able to run sudo without authenticating. This makes it a big security risk so be very careful with this command.

Also check https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands

Erjen Rijnders

Posted 2019-10-25T06:56:20.127

Reputation: 181

Thanks. What about ALL:(ALL)? I know it has something to do about users and groups but I don't understand Linux groups as it is so if you can help me out, that would be awesome. – Nabeel Parkar – 2019-10-25T07:40:25.793

With that command, you just give ALL permissions. You must still authenticate. – Erjen Rijnders – 2019-10-25T07:47:23.450

If you mean the exact function of the ALL=(ALL:ALL) ALL. The first ALL is the users allowed, the second one is the hosts, the third one is the user as you are running the command, the last one is the commands allowed. Check: https://unix.stackexchange.com/questions/201858/what-does-all-all-all-all-mean-in-sudoers

– Erjen Rijnders – 2019-10-25T07:48:37.883

The sudoers man page describes this in great detail. Thrre are several default alias used in this line.

The format is;

user_spec runas_spec=(host_spec) NOPASSWD:cmd_spec

user_spec identifies which users can use the rule.
runas_spec identifies which users the commands can be run as.
(host_spec) identifies which hosts which hosts the rule applies to. This is optional and defaults to ALL.
NOPASSWD: or PASSWD: specifies whether a passord is reqruired. This is optional and defaults PASSWD unless the default has been changed in sudoers configuration.
cmd_spec identifies which commands the rule can be run for.

It is common to use aliases for the various specs. Each spec has a predefined alias ALL, which is self-explanatory.

BillThor

Posted 2019-10-25T06:56:20.127

Reputation: 9 384