Question 4

Explanation

Step-by-Step Solution

Step 1: Create the User Account

1. Command:

   $ sudo useradd Samir

   • Explanation: Creates a new user account named Samir.

Step 2: Set the User's Password

1. Command:

   $ sudo passwd Samir

   • Explanation: This command assigns a password to Samir, enabling him to log in.

Step 3: Grant sudo Privileges to Samir

Choose one of the following methods:

• Method A: Modify the sudoers File (For Granular Control)

  1. Open the sudoers File Using visudo:

     $ sudo visudo

     • Explanation: visudo opens the sudoers file in a safe environment, preventing syntax errors from locking you out.

  2. Add Sudo Permissions for Samir:

     • Add this line below the section “Allow root to run any commands anywhere”:

       Samir ALL=(ALL) ALL

     • Explanation:

       • Samir: Specifies the user to grant permissions to.

       • ALL=(ALL): Allows Samir to run commands as any user or group.

       • ALL: Permits Samir to execute all commands.

     • Save and Exit: Press Esc, type :wq, and hit Enter.

• Method B: Add Samir to the wheel Group (Simpler, if Applicable)

  1. Add Samir to the wheel Group:

     $ sudo usermod -aG wheel Samir

     • Explanation: The wheel group typically has sudo privileges configured in /etc/sudoers, simplifying management for users who need full sudo access.

  2. Verify wheel Group Permissions in sudoers:

     • Ensure that the following line exists in /etc/sudoers to enable sudo for wheel group members:

       %wheel ALL=(ALL) ALL

Step 4: Verify Sudo Access

1. Command:

   $ sudo -l -U Samir

   • Explanation: This lists the commands Samir can run with sudo, verifying that privileges are set up correctly.

Key Points and Best Practices

• Understanding sudo Privileges:

  • Authentication: Samir will authenticate with his own password, not the root password, for security and accountability.

  • Logging: Commands executed with sudo are logged in /var/log/secure, which helps in tracking privileged actions.

  • Password Timeout: By default, sudo sessions last for 5 minutes of inactivity before requiring re-authentication.

• Alternative Options:

  • Limiting Privileges: For limited sudo access, grant Samir permission only for specific commands. For example:

    echo "Samir ALL=(ALL) NOPASSWD:/usr/bin/systemctl" | sudo tee /etc/sudoers.d/Samir

    • Explanation: This allows Samir to run systemctl commands without a password prompt, while restricting access to other commands.

• Security Considerations: Carefully assess the need for sudo privileges, especially if full access is unnecessary, as excessive privileges can pose security risks.