sudo — Privilege delegation execution

💬 "sudo command"

sudo lets you run only the commands you need with administrator privileges. It is the standard way to reduce direct root logins.

Policies are managed in /etc/sudoers and /etc/sudoers.d and are edited with visudo.

• Concept: Runs allowed commands with another user's privileges (root by default).
• -l: View the list of commands the current account can run.
• -u: Specify the user to run as.
• Policy: Manage through files in /etc/sudoers.d/.

Frequently used options

Three essential command combinations

• sudo -l — Check which administrator commands I can use
• sudo -n systemctl status nginx — Check whether status can be checked without a password
• visudo -c — Validate sudoers file syntax

💬 "Tell me one way to use it while saving resources."

Common situations on production servers are organized in order.

Step 1 · Check permissions

See what you can do with sudo.

sudo -l

Step 2 · Execute

Run only the necessary command with administrator privileges.

sudo systemctl restart nginx

Step 3 · Audit

Check sudo usage records.

journalctl -t sudo -n 20 --no-pager

How it is used in practice

1. Deployment automation privileges

Situation — CI should only use sudo to restart services.

grep -r ci-deploy /etc/sudoers.d/ && sudo -n systemctl restart myapp

Result — Only allowed commands run without a password.

Point — It is safer to allow only the necessary commands instead of full ALL privileges.

2. sudo auditing

Situation — Check who ran administrator commands.

journalctl -t sudo --since today --no-pager | tail -20

Result — User, command, and time are recorded and used for auditing.

Point — Also check sudo usage by automation accounts.

Important notes

• NOPASSWD ALL is effectively the same as root. Restrict commands to the minimum.
• Directly editing sudoers can block sudo itself due to a syntax error, so always use visudo.
• Run commands that affect production only after an approval process.

Actual execution screen

This shows the result of confirming the allowed sudo command list and passwordless execution.

!sudo command execution result: allowed command list and execution

Live production server

Source (HTML): https://games.aidebatehub.com/programs/linux/security/sudo.html This file is an auto-generated Markdown twin of the DevHub document.