Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently, I have changed the sudoers file and the hostname through /etc/hostname. After changing this files, my sudo command is taking a lot of time. Also, it says sudo unable to resolve host kaagini(hostname of my machine).

Why does sudo have to know the hostname for providing permission to something ??

My sudoers file has a command "Defaults env_reset". I saw some similar questions but the context is not a remote login here. The error is showing on a localhost.

Initial googling for the problem says that the /etc/hosts file must have the actual hostname for 127.0.0.1 . This fixed my issue. But my actual question is : Why do we require this for sudo ?? Should the sudo work irrespective of the place of login.

share|improve this question
    
    
@OliverSalzburg I have rephrased the question properly. Kindly let me know if anything is wrong –  prathmesh.kallurkar May 28 '12 at 18:28

1 Answer 1

up vote 2 down vote accepted

The /etc/sudoers file is designed to be able to be distributed among multiple servers. In order to accomplish this, each permission in the file has a host portion.

This is usually set to ALL= which means that the permission is valid for any server, however it can be set to specific hosts:

%sudo    kaagini=(ALL) ALL

In order for sudo to know wether this rule should be applied, it needs to lookup the host it is running on. It uses a call that relies on the /etc/hosts being correct, which is why it fails if it is not right.

It might be argued that sudo doesn't need to bother doing a name lookup if the host portion is set to ALL= for all permissions, but it just doesn't work that way - it appears to work out where it running is prior to processing the rules.

This is really for ease of maintenance as sudo only reads /etc/sudoers to see what the user can do on the current machine. But as an admin with 100 servers, this might require 100 different /etc/sudoers files to maintain. Because sudoers has a host portion in the permissions, you can maintain a single sudoers file and distribute it to all machines, yet still have granularity over what users can do on each machine.

share|improve this answer
    
Thanks for the answer. Can you come at the distributed sudoers file again ?? See, i have an operating system running on machineA. Should the permissions file (/etc/sudoers) for this Operating System be stored on other machines. Or your answer means to say that sudo command can say something like user John can sudo from machineA but not from machineB ?? –  prathmesh.kallurkar May 29 '12 at 8:51
    
It is really for ease of maintenance. sudo only reads /etc/sudoers to see what the user can do on the current machine. But as an admin with 100 servers, this might require 100 different /etc/sudoers files to maintain. Because sudoers has a host portion in the permissions, you can maintain a single sudoers file and distribute it to all machines, yet still have granularity over what users can to on each machine. –  Paul May 29 '12 at 13:36
    
perfect ... thanks dude –  prathmesh.kallurkar May 29 '12 at 16:29
    
one more question... does the server administrator have to scp the new sudoers file every time there is a change in the main sudoers file or does sudo provide a way to maintain the sudoers file over the network ?? –  prathmesh.kallurkar May 29 '12 at 16:32
    
@prathmesh.kallurkar No, there isn't a built-in method of distributing, but this is linux, so this is normal. You would use rsync or scp or another tool to get this part done. –  Paul May 29 '12 at 23:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.