SUDO SCRIPT

# sudoers file.

#

# This file MUST be edited with the 'visudo' command as root.

# Failure to use 'visudo' may result in syntax or file permission errors

# that prevent sudo from running.

#

# See the sudoers man page for the details on how to write a sudoers file.

#

# Host alias specification

# User alias specification

# Cmnd alias specification

Cmnd_Alias      WEBADMIN        = /etc/init.d/ibm-http, /usr/bin/vi /opt/IBM/HTTPServer/conf/*, /opt/IBM/HTTPServer/bin/*

Cmnd_Alias      MONITOR         = /bin/cat, /bin/grep, /bin/more, /usr/bin/head, /usr/bin/tail, /usr/bin/less, /var/log/*

Cmnd_Alias      PASSWDROOT      = !/usr/bin/passwd root

Cmnd_Alias      SECURITY        = /bin/ls,/bin/more,/bin/cat,/usr/sbin/useradd,/usr/sbin/usermod,/usr/sbin/userdel,/usr/sbin/groupadd,/usr/sbin/groupmod,/usr/sbin/groupdel,/usr/bin/passwd,/bin/chown,/bin/chmod,/usr/bin/getfacl,/usr/bin/setfacl

Cmnd_Alias      SYSADMIN        = /bin/*, /sbin/*, /user/bin/*, /usr/sbin/*

Cmnd_Alias      OPERATION       = /sbin/shutdown

Cmnd_Alias      VISUDO          = /usr/sbin/visudo

Cmnd_Alias      SUROOT          =!/bin/su -, !/bin/su - root, !/bin/su root

# Defaults specification

# prevent environment variables from influencing programs in an

# unexpected or harmful way (CVE-2005-2959, CVE-2005-4158,

# CVE-2006-0151)

Defaults always_set_home

Defaults env_reset

# In the default (unconfigured) configuration, sudo asks for the root password.

# This allows use of an ordinary user account for administration of a freshly

# installed system. When configuring sudo, delete the two

# following lines:

#Defaults targetpw    # ask for the password of the target user i.e. root

#ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!

# Runas alias specification

# User privilege specification

root    ALL=(ALL) ALL

%sysadmin       ALL=SYSADMIN,OPERATION,MONITOR,SECURITY,VISUDO,WEBADMIN, SUROOT

# Uncomment to allow people in group wheel to run all commands

# %wheel        ALL=(ALL) ALL

# Same thing without a password

# %wheel        ALL=(ALL) NOPASSWD: ALL

# Samples

# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom

# %users  localhost=/sbin/shutdown -h now