0

To do this, I seem to have two options:

  1. add (user) to the sudo Group:
# usermod -aG sudo <user>
  1. add (user) to /etc/sudoers
# visudo /etc/sudoers
.........
<user> ALL=(ALL:ALL) ALL
....

Are these two methods equivalent, or is one better than the other, and why?
mazda
  • 477

1 Answers1

1

The reason why your method #1 (adding the user to the sudo group) works because your /etc/sudoers already contains the following line:

@sudo ALL=(ALL:ALL) ALL

i.e. "let anyone who is a member of the sudo group run all commands as all users via the sudo command".

So yes, within the system that has that line as standard, the two methods have exactly the same effect. If you grant to user1 sudo access with your method #1 and to user2 with your method #2, and then compare the outputs of

sudo -l -U user1
sudo -l -U user2

you'll find that the resulting sudo configurations for the users, and so the resulting outputs, will be identical.

However, you should note that the sudo group membership can be useful on its own too: you could use it to make some logs group-readable to the administrators even if they are not currently actively using their root powers, or you could make a directory that is group-writeable by anyone that has root power and use that for sysadmin documentation, for example.

So if you want to do any of that, or even think you might do it at some future time, I would say method #1 would be slightly better. But no matter what you choose, I would urge you to pick a method and stick with it for consistency: don't add some users with method #1 and others with method #2.

telcoM
  • 5,167