sudo & Account Security

What is it?

sudo grants specific users limited, audited root access instead of sharing the root password. Account security means strong auth, no shared logins, and disabling or expiring accounts that should not exist.

Why it matters

Most Linux compromises abuse credentials and privilege. Least-privilege sudo plus tidy accounts shrinks the blast radius and makes actions attributable.

Where you see it

`/etc/sudoers` (edited via visudo) defines who may run what as root; `sudo` use is logged to auth.log; `getent passwd` lists accounts.

What normal looks like

A small set of named admins in a sudo group, each accountable; no direct root logins; service accounts with no interactive shell.

What suspicious looks like

A user with unrestricted `ALL=(ALL) NOPASSWD:ALL`, a shared root login, or a stale account that still has a shell — each a privilege or attribution gap.

How analysts investigate

Review sudoers for over-broad grants, check auth.log for who used sudo for what, and audit accounts for interactive shells that should be locked.

Common beginner mistakes

Granting NOPASSWD:ALL for convenience — it removes the audit and the friction.
Sharing the root password instead of per-admin sudo (no attribution).

Least privilege, fully attributed

  /etc/sudoers (via visudo):
    %sysadmin ALL=(ALL) ALL          ← named admins, password required, logged
    deploy ALL=(ALL) NOPASSWD:ALL    ← RED FLAG: unrestricted, no password, no friction
  auth.log:  j.rai : TTY=pts/0 ; COMMAND=/usr/bin/systemctl restart nginx

sudo gives named, logged, least-privilege root; NOPASSWD:ALL removes both the check and the audit.

Quick check

Which sudoers line is the security risk?

A quick self-check — it doesn't affect your XP or progress.