Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is no chance of an internal attack, so I would like to give sudo privileges to users at the local computer using sudoers. I tried these lines separately:

%admin localhost=(ALL) NOPASSWD: ALL

But sudoers does not seem recognize either localhost or

Is there an alternative, and if so, how secure would it be? Could a remote attacker gain local user privileges using cron or some other method?

share|improve this question

migrated from Jul 29 '10 at 11:14

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted


The host list restricts the sudo rule to hosts on which one network interface has a name or address in the list. Since every host has a loopback interface, every host should match your rule; in fact, sudo skips the loopback interface when checking host lists, so no host does match your rule; either way specifying the host as localhost is not useful.

Sudo doesn't do any network authentication: the host list is there so that you can deploy a single sudoers file on multiple machines and give users different permissions on different machines.

Cron also doesn't do any network authentication. A remote user would gain user privileges through a misconfigured or vulnerable network server or client (http, ftp, samba, nfs, snmp, ssh, …).

share|improve this answer
"Since every host has a loopback interface, every host matches your rule." Are you sure that's correct? Neither localhost nor seem to match the local computer. – Zaz Jul 29 '10 at 20:56
@Josh: that's the documented behavior. In fact sudo skips the loopback interface when checking whether the host is in the list. I've updated my answer to reflect this. Either way, specifying localhost in the host list is not useful. – Gilles Jul 29 '10 at 21:25
Every host would match your rule, if the sudo system allowed it. – bukzor Apr 2 '13 at 17:12

It seems that your hostname is not a "localhost". See output hostname command or check content your /etc/hostname

share|improve this answer
How is hostname going to help ? Can you elaborate – pun Jan 22 at 12:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .