Exercise: Grant limited root access

Grant limited root access

• Switch to root with su - and sudo -i.
• Write, check and test a narrow sudo rule.
• Find sudo's record of allowed and refused commands.

Start the exercise

On workstation, start the exercise. It removes a tester account and sudo rule left by an earlier run from servera.

[student@workstation ~]$ lab start sa-sudo

Later tasks assume that you are logged in to the server they name: ssh student@servera from workstation, then sudo -i for a root shell.

Become root with su -, then with sudo -i

On servera, as student. root's password in the lab is redhat; student's is student.

[student@workstation ~]$ ssh student@servera
[student@servera ~]$ su -
Password:
[root@servera ~]# whoami
root
[root@servera ~]# exit
logout
[student@servera ~]$ sudo -i
[sudo] password for student:
[root@servera ~]# exit
logout

Both give a root shell. su - needed root's password; sudo -i needed yours.

Create a user without sudo rights

Create the user tester with the password tester123. You'll meet useradd properly in the next lesson.

[student@servera ~]$ sudo useradd tester
[student@servera ~]$ sudo passwd tester
Changing password for user tester.
New password:
BAD PASSWORD: The password contains the user name in some form
Retype new password:
passwd: all authentication tokens updated successfully.

The warning is advice: root may set a weak password anyway, which is fine in a practice lab.

Confirm that tester can't use sudo

[student@servera ~]$ su - tester
Password:
[tester@servera ~]$ sudo id
[sudo] password for tester:
tester is not in the sudoers file.
[tester@servera ~]$ exit
logout

Allow tester to check any service, and nothing more

Create /etc/sudoers.d/tester with a rule that lets tester run systemctl status with any arguments as root. Make it readable only by root and check the syntax.

[student@servera ~]$ sudo -i
[root@servera ~]# echo 'tester ALL=(ALL) /usr/bin/systemctl status *' > /etc/sudoers.d/tester
[root@servera ~]# chmod 440 /etc/sudoers.d/tester
[root@servera ~]# visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/tester: parsed OK
[root@servera ~]# exit

The single quotes stop the shell from expanding the *: it must reach the file as a literal *.

Test the rule from both sides

[student@servera ~]$ su - tester
Password:
[tester@servera ~]$ sudo -l
[sudo] password for tester:
...output omitted...
User tester may run the following commands on servera:
    (ALL) /usr/bin/systemctl status *
[tester@servera ~]$ sudo systemctl status sshd | head -3
● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)
     Active: active (running) since Sat 2026-10-03 10:30:07 UTC; 2min 27s ago
[tester@servera ~]$ sudo systemctl restart sshd
Sorry, user tester is not allowed to execute '/bin/systemctl restart sshd' as root on servera.lab.example.com.
[tester@servera ~]$ exit

Read the record, then clean up

[student@servera ~]$ sudo grep 'tester :' /var/log/secure
...  tester : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/tester ; USER=root ; COMMAND=/bin/id
...  tester : TTY=pts/1 ; PWD=/home/tester ; USER=root ; COMMAND=/usr/bin/systemctl status sshd
...  tester : command not allowed ; TTY=pts/1 ; PWD=/home/tester ; USER=root ; COMMAND=/bin/systemctl restart sshd
[student@servera ~]$ sudo rm /etc/sudoers.d/tester
[student@servera ~]$ sudo userdel -r tester
[student@servera ~]$ exit

Each line shows who, from which directory, as whom and what, and whether sudo allowed it.

Grade and finish

Check your work with lab grade sa-sudo, then put the exercise away with lab finish sa-sudo.