4

There is a server that was setup a while back, and I need to change a few settings, one of which is a user with super user privileges. However, everywhere I look tell to use visudo, or edit /etc/sudoers, but none of these things exist on this server.

$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 10 (buster)
Release:    10
Codename:   buster
$ whereis visudo
visudo:
$ visudo
-bash: visudo: command not found
$ ls -l /etc/sudoers
ls: cannot access '/etc/sudoers': No such file or directory

Where would that configuration be?

** EDIT **

To be clear, the user can su without a password, so that's setup somewhere, but since /etc/sudoers does not exist, and visudo is not installed (neither is sudo), where would that config be?

Yanick Rochon
  • 1,124

2 Answers2

6

To be clear, the user can su without a password, so that's setup somewhere,

Somewhere else than sudoers, certainly. They are completely independent commands – su has its own logic for granting root rights and does not use 'sudo' or 'sudoers' for anything, whether it's passwordless or not. They just have similar names.

The regular Linux 'su' mostly relies on PAM configuration: if you can pass the PAM authentication, then you can get root privileges. Now usually this is set up to call your usual password-checking module (pam_unix or other), but other modules can be used as well – indeed the default /etc/pam.d/su often has an example of exactly the kind of passwordless mode that you're looking for:

Default /etc/pam.d/su from Arch Linux:

#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            required        pam_unix.so

So if your 'su' is passwordless, chances are it uses pam_wheel in its PAM stack (/etc/pam.d/su). Check if that's the case, and if so, use gpasswd to add or remove people from the "wheel" group.

grawity
  • 501,077
0

You don't have visudo and the sudoers file because you don't have sudo installed. Install it with this command as root:

apt install sudo
gronostaj
  • 58,482