{"id":17462869,"url":"https://github.com/mralias/sudo","last_synced_at":"2025-03-28T06:41:04.365Z","repository":{"id":32118983,"uuid":"35691445","full_name":"MrAlias/sudo","owner":"MrAlias","description":"Puppet module providing fully customized configuration and management of the Sudo program","archived":false,"fork":false,"pushed_at":"2015-10-02T20:36:39.000Z","size":268,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-02-02T07:26:15.579Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MrAlias.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-05-15T19:01:37.000Z","updated_at":"2015-09-15T15:52:40.000Z","dependencies_parsed_at":"2022-09-11T13:11:31.189Z","dependency_job_id":null,"html_url":"https://github.com/MrAlias/sudo","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MrAlias%2Fsudo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MrAlias%2Fsudo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MrAlias%2Fsudo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MrAlias%2Fsudo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MrAlias","download_url":"https://codeload.github.com/MrAlias/sudo/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245984561,"owners_count":20704794,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-18T09:10:17.930Z","updated_at":"2025-03-28T06:41:04.323Z","avatar_url":"https://github.com/MrAlias.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# sudo\n\n**Notice**: This module is still a work in progress.  I do not recommend production use until this notice is removed.\n\n#### Table of Contents\n\n1. [Module Description](#module-description)\n2. [Setup](#setup)\n    * [What sudo affects](#what-sudo-affects)\n    * [Beginning with sudo](#beginning-with-sudo)\n3. [Usage](#usage)\n4. [Reference](#reference)\n    * [Classes](#classes)\n5. [Limitations](#limitations)\n\n## Module Description\n\n[Sudo](http://www.sudo.ws) is powerful tool used to manage extending users privileges.  This module is intended to offer extended customizability of sudo configuration in order to fully leverage its use.\n\n## Setup\n\n### What sudo affects\n\n* The sudo package.\n* The main sudo configuration file (*/etc/sudoers*).\n* Potentially the rkhunter database if the rkhunter package is installed.\n\n### Beginning with sudo\n\nTo install sudo with a basic configuration:\n\n```puppet\ninclude sudo\n```\n\n## Usage\n\n### Providing custom configuration.\n\nThe `sudo` class is the main class of the module and is where all configuration is done.\n\n```puppet\nclass { 'sudo':\n  defaults_content     =\u003e 'Defaults\teditor=/usr/bin/vim, env_reset, mail_badpass, noexec',\n  host_aliases_content =\u003e 'Host_Alias\tSANS = backup1, backup2',\n  user_aliases_content =\u003e 'User_Alias\tPEONS = jim, joe, jack',\n  cmnd_aliases_content =\u003e 'Cmnd_Alias\tBACKUP = /bin/tar, /bin/cpio, /bin/mount',\n  runas_spec_content   =\u003e 'PEONS\tSANS = (admin) EXEC: BACKUP',\n}\n```\n\nOf course if you need to add more complex content you can pass in a file or template output.\n\nIf the content of the created policy contains invalid syntax the module will remove the configuration file instead of installing a broken sudoers policy.\n\n### Including your own custom files\n\nIf passing content to the main sudoers policy is not flexible enough to achieve the desired configuration, you can directly manage the configuration files and just include them in the main policy.\n\n```puppet\nfile { '/home/me/my_policies/polity1':\n  ensure  =\u003e file,\n  content =\u003e tempate('/path/to/templates/polity1'),\n}\n\nfile { '/home/me/my_policies/policy2':\n  ensure  =\u003e file,\n  content =\u003e template('/path/to/templates/policy2'),\n}\n\nclass { 'sudo':\n  include =\u003e ['/home/me/my_policies/polity1', '/home/me/my_policies/polity2']\n}\n```\n\n### Configuring with Hiera\n\nThe `sudo` class was designed with the intent that hiera would be used in parameter definition.  If merging is enabled even more specific policy can be generated. Given a hierarchy like the following defined in `hiera.yaml`:\n\n```yaml\n---\n:backends:\n  - yaml\n:hierarchy:\n  - \"role/%{::role}\"\n  - common\n:yaml:\n   :datadir: /etc/puppet/hieradata\n:merge_behavior: deeper\n```\n\nA base configuration can be established in `common.yaml`:\n\n```yaml\n# common.yaml\n---\nsudo::defaults_content: 'Defaults\teditor=/usr/bin/vim, env_reset, mail_badpass, noexec',\nsudo::host_aliases_content: 'Host_Alias\tSANS = backup1, backup2',\nsudo::user_aliases_content: 'User_Alias\tPEONS = jim, joe, jack',\nsudo::cmnd_aliases_content: 'Cmnd_Alias\tBACKUP = /bin/tar, /bin/cpio, /bin/mount',\nsudo::runas_spec_content: 'PEONS\tSANS = (admin) EXEC: BACKUP',\n```\n\nNow if you want you the new guy, Albert, to be able to only work on the demo servers:\n\n```yaml\n# role/demo.yaml\n---\nsudo::user_aliases_content: 'User_Alias\tPEONS = jim, joe, jack, albert',\n```\n\n### Integration with rkhunter\n\n[Rkhunter](http://rkhunter.sourceforge.net) is a great tool to help monitor system security.  It will, however, error if you update the sudoers policy without notifying it of the change.  This module does that for you if you say to:\n\n```puppet\nclass { 'sudo':\n  runas_spec_content =\u003e '%sudo\tALL = (ALL:ALL) ALL',\n  update_rkhunter    =\u003e true,\n}\n```\n\n## Reference\n\n### Classes\n\n#### sudo\n\nManages the Sudo package and its authorization capabilities.\n\n##### `sudo::package_name`\n\n(String) Name of sudo package the module will install.\n\nDefault value: `'sudo'`\n\n##### `sudo::sudoers_file`\n\n(Absolute Path) Location of the main sudoers configuration file.\n\nDefault value: `'/etc/sudoers'`\n\n##### `sudo::include`\n\n(Array) File paths to include in the sudoers policy.\n\nDefault value: `[]`\n\n##### `sudo::include_dir`\n\n(String) Absolute path to directory for system package policies.\n\nThis ensures the directory is specifies in the main policy to be included as the place where the system package manager can drop sudoers rules into as part of the package installation.\n\nDefault value: `'/etc/sudoers.d'`\n\n##### `sudo::include_dirs`\n\n(Array) Directories to include in the main sudoers file.\n\nAll additional files found in these directories are treated as sudo configuration files.\n\nDefault value: `['/etc/sudoers.d']`\n\n##### `sudo::defaults_content`\n\n(String) Content of the defaults section of the sudoers file.\n\n##### `sudo::host_aliases_content`\n\n(String) Content of the host\\_aliases section of the sudoers file.\n\n##### `sudo::user_aliases_content`\n\n(String) Content of the user\\_aliases section of the sudoers file.\n\n##### `sudo::cmnd_aliases_content`\n\n(String) Content of the cmnd\\_aliases section of the sudoers file.\n\n##### `sudo::runas_spec_content`\n\n(String) Content of the runas\\_spec section of the sudoers file.\n\n##### `sudo::update_rkhunter`\n\n(Boolean) Specify if rkhunter should be updated after any change is made.\n\nAny changes to the sudoers policy will cause rkhunter to error.  This provides a convenient way to automatically update rkhunter of changes to the sudoers policy.\n\nDefault value: `false`\n\n## Limitations\n\nThis module has received limited testing on Debian based operating systems and CentOS 7.0.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmralias%2Fsudo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmralias%2Fsudo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmralias%2Fsudo/lists"}