How do I get a list of users who are allowed to use sudo?

Question

How do I get a list of users who are allowed to use sudo?

There is a server with a large number of system users who have access to it via SSH.

As part of the access inventory task, you need to get a list of all users who are allowed to become root on this server via sudo.

It is clear that about a single user, you can see the output id username for the wheel group (which out of the box gives CentOS the ability to become a root through sudo), but how would you get a list of all such groups users? It is clear that you can write a loop in which to iterate over the output id for all users of the system, but is it possible to do something more elegant?

4

linux sudo

Author: AntonioK, 2016-11-14

Source

2 answers

score 5 · Answer 1

A universal way to get a list of users of a specified group is using the getent program called for the group database (there are many databases, see the documentation: $ man getent):

$ getent group название-группы

Sample output:

название-группы:x:1000:пользователь1,пользователь2,пользователь3

Most often, this is just a string from the /etc/group file, which could also be obtained with the

$ grep '^название-группы:' /etc/group

But not always - because there are different authentication mechanisms that store data at all in a different way.

Supplement

And as for the global issue-getting a list of users who are allowed to run the program sudo, there is no short, universal and simple solution, as far as I know. you either need to parse the files /etc/sudoers*, or, after getting a complete list of users from all authentication subsystems (using $ getent passwd), analyze the output of the command for each user (it will not work on older versions of the program sudo):

$ sudo -l -U пользователь

Sample output:

User пользователь is not allowed to run sudo on ...

score 3 · Answer 2

In CentOS, you can see a list of all users belonging to a certain group using the lid command, for example, the list of all group members wheel (who are allowed to execute commands as and with root rights using sudo out of the box) can be seen like this:

$ sudo lid -g wheel --
 i.ivanov(uid=1000)
 p.petrov(uid=1001)
 v.pupkin(uid=1008)

It should be understood, however, that sudoers can be set to "become root" for other groups (or for individual users), so it is also necessary to study the contents of sudoers (the command visudo).