21

This might be a very naive question, but I wanted to know how I could give multiple users access to a single computer without making them root users. How would I give them limitted sudo access such that they could still issue commands like

sudo apt-get install epstopdf

I imagine this could be an incredibly stupid question as once root user access is given, they could do whatever they want. Therefore, is there any way around this? I am open to suggestions

puk
  • 1,161

3 Answers3

29

Open a terminal and type sudo visudo. At the end of the file (really the last line in it) type %yourusername% ALL=NOPASSWD: /usr/bin/apt-get install where %yourusername% is replaced by your username.

After that you wont be prompted for a password to use sudo apt-get install anymore but please understand this is a very risky solution, there is a reason why you need to type a password for some commands, the use of these commands without password can leave your system open for some dangers. Use with caution.

Bruno Pereira
  • 73,643
  • Could sudo apt-get install lead to problems by, for example, installing a program which does rm -f -r / ? – puk Oct 31 '11 at 20:43
  • 4
    Well, no not really. And if it does you need to type sudo rm -rf / and the instructions I gave are only to enable sudo apt-get install, even if you enable a PPA that has that kind of code, even if you install it without really knowing what you are doing and the program tries to run he wont have access... You did not give yourself sudo rm permition, only sudo apt-get install. Its the safest approach to a insecure situation ;) – Bruno Pereira Oct 31 '11 at 20:50
  • fixed the path to the file was wrong :D the path was not /usr/sbin but /usr/bin ;) it just works – Bruno Pereira Oct 31 '11 at 21:15
  • Sudo with a password isn't much more secure than without. In fact in someways it can be considered less secure depending on the situation. If you are in a position to use the sudo command it's fairly easy to override it in a bash profile. You can install a fake sudo that logs the password. Having the password would allow other hosts to be compromised (if they allow password logins), or other sudo commands to be run. If you allow passwordless sudo for specific commands then that isn't such an issue. One time passwords are also another possibility but you can still hijack the sudo. – David C. Bishop Dec 13 '14 at 22:42
  • 2
    On Ubuntu 15.04 this disallows a meaningful install, allowing literally sudo /usr/bin/apt-get install with no parameters. If a package name is added then sudo asks for a password and gives a "Sorry..." error. – Paul Jun 05 '15 at 05:03
  • I'm second guessing myself here because % holds significance in that file. Should they be removed or left behind? why even use them at all in the example? – Daniel Kaplan Feb 02 '22 at 06:47
9

sudo is exactly made for that. By editing the sudoers file you can give users specific privileges. See the manual page of sudoers(5) for details.

David Foerster
  • 36,264
  • 56
  • 94
  • 147
Michael K
  • 13,888
2

From my answer to similar question on the Linux stachkexchange: link

For me the option with visodo required additional steps:

  1. Add yourself to the sudousers:

Login as root via su -, open sudo editor by visudo and add next lines:

%yourusername% ALL=NOPASSWD: /usr/bin/apt-get install
%yourusername% ALL=NOPASSWD: /var/lib/dpkg/lock-frontend

  1. Exit session(root and yours) typing exit <Enter> exit <\Enter>

  2. Reopen it and type:

     sudo chown  %yourusername%: /var/lib/dpkg/lock-frontend
 chmod  u+w /var/lib/dpkg/lock-frontend 
 sudo chown  %yourusername%: /var/lib/dpkg/lock
 chmod  u+w /var/lib/dpkg/lock
 sudo chown  %yourusername%: /var/cache/apt/archives/lock
 chmod  u+w /var/cache/apt/archives/lock
 sudo chown  %yourusername%:  /var/lib/apt/lists/lock
 chmod  u+w  /var/lib/apt/lists/lock

PS: I also added the visudo file lines to allow myself to update repos list:

%yourusername% ALL=NOPASSWD: /usr/bin/apt-get update
Stadub Dima
  • 121
  • 4