Something I wish I had fully understood, long ago, when setting up admin privileges with any Linux or specifically openSUSE systems is how to make it work in a more slick, usable and friendly manner. I specifically like the default Ubuntu approach to managing sudo behavior. When you “sudo” you enter your user password to do root or admin privilege tasks. In contrast, on openSUSE the default is to enter the root password. For a single user setup, this is not a problem but on a multi-user deployment this behavior is not very convenient. I just don’t think it is a a good approach to give the various users root password to do administrative functions. Although I did some cursory searching, I didn’t find an answer that was clear enough for me to implement so I did the shameful thing and just provide the root credentials to the small team of individuals I am working with, but that is no more!
This is my solution for making root / admin tasks much cleaner and easier to accomplish for those that are tasked to do so in this environment. I don’t claim to be a security expert and there are potentially even better ways to manage this but for my small team, I am taking advantage of the “wheel” group by adding the users to that group and modifying the sudoer file to allow any user with that group administrative privileges. It is much easier to remove a user from the group than to change the root password. I also don’t particularly like the whole root user thing to do system tasks. Feel free to comment and criticize on this and maybe I’ll change my ways.
Wheel Group
I have always been puzzled by the wheel group, why was it there, what is its purpose and the like but now I know. After digging into the /etc/visudo file, I see, near the end there is a User privilege specification. Here you can manually enter who gets root, but you can also set a group that any user that is a part of the group will have the root permissions.
Add the wheel group to a user. This can be done in several ways, the most universal way would be in the terminal. As root user you would run the following:
usermod -aG GROUP USER
To explain this command because it is not a good idea to run any command without understanding what it is:
-a, append the user to the supplemental GROUPS mentioned by the -G option without removing the user from any other groups
-G, list of supplementary GROUPS, which means you can add multiple groups separated by commas. Example: wheel,dialout,lock USER would add the USER to the listed groups.
To add the wheel group to the user cubiclenate, I would run the following as root:
usermod -aG wheel cubiclenate
I also want to note that you can separate out the options, so this would yield the same result:
usermod -a -G wheel cubiclenate
For a graphical interface, you can utilize YAST on the openSUSE family of distributions and add them through a rather comfortable interface.
One way I am using this is to more easily manage printers without the annoying “enter root user” every time you need to make a change.
User Friendly Printer Management | openSUSE (Post-YaST)
Clean Official Way
Recently, there has been a package to give openSUSE Tumbleweed / Leap that “Ubuntu Style’ sudo management. One of my annoyances was having to use the root password for sudo functions so having a system in an enterprise with more than one admin made this very clunky. The easy way to fix this is to install this package:
sudo zypper in sudo-policy-wheel-auth-self
Any user you want to have this clean sudo capability, just add that user to the wheel group.
And your are done!
No Password for sudo
I have run with this method for a while but becoming a bit more paranoid as of late, I have rolled this back on some machines. The idea here is when you run the sudo command and you are a part of the wheel group, the command just runs. I like it because it makes things fast but it is dangerous because there isn’t that second thought about your actions in the terminal or the potential for someone to get in and do a thing that potentially destroys your system (uh, lock your computer). We can debate this but it’s your computer, do with it as you please.
There are a couple ways to go about doing this. The most traditional way is to run this in the terminal:
sudo visudo
Which will open up a VI session of sudo which allows you to make any changes to the sudoers file. Alternatively, you can use your favorite editor to make the changes, like micro or nano:
sudo nano /usr/etc/sudoers
Here is where you make the sudo magic happen. Scroll down, near the bottom of the text file and look for:
%wheel ALL=(ALL:ALL) NOPASSWD: ALL
Uncomment the leading #, save and quit out of the editor.
Testing it Out
If you have not already logged out after adding the wheel group to your user, do so now, come back into your session (graphical or terminal) and test out the changes. Now, when you go to do updates on your system or run any other command that requires root, just do as you have been doing but now you won’t have to enter your root password.
In this case, I ran the command to do updates in openSUSE Tumbleweed
sudo zypper dup
There was nothing to do this time but other tasks that I hop in the terminal to do is quickly switching Tailnets between home and work.
sudo tailscale switch home
Conveniently, I don’t have to enter my password now and I just get that immediate switch to the my home Tailnet. This is incredibly convenient for this particular task.
Another task that I need root access is for mounting and unmounting my NFS share.
sudo mount -t nfs optimus:/home/wolfnf/ /mnt/optimus/wolfnf/ -o nofail,x-systemd.automount,x-systemd.mount-timeout=10,x-systemd.idle-timeout=5min
Then unmounting as necessary
sudo umount /mnt/optimus/wolfnf
Suffice to say, this is an incredible “quality of life” improvement on my Linux desktop.
Final Thoughts
Security, there are so many opinions out there about what is more or less secure in how you manage administrative level tasks on your machines. Does this make your user account less secure? Perhaps yes, I could argue that it does indeed make your user account less secure. For a server that multiple people are accessing, however, using other enhanced security features like pre-shared ssh keys, I would argue that this is far more secure than sharing the root password around on a server. You will have to evaluate your risks and determine what is more or less secure for your use case.
Keep in mind that security is a funny thing. A machine that is not accessible is the most secure but also the least productive. A machine with no security may be incredibly productive but becomes vulnerable. You will have to determine what is the most secure way to administer your machines that doesn’t significantly compromise productivity. Not everyone needs access to everything and your weakest link in the security chain will always be the end user.
References
https://www.howtogeek.com/50787/add-a-user-to-a-group-or-second-group-on-linux/
Pre-shared SSH Key
NFS and FS-Cache | Faster Performance with Distributed Storage
User Friendly Printer Management | openSUSE (Post-YaST)
Leave a Reply