2

According to the OpenBSD FAQ #10:

If you want to give access to superuser privileges without adding users to the wheel group, use sudo(8).

According to the OpenBSD man pages on sudo(8):

sudoedit  [-AnS] [-a auth_type] [-C fd] [-c class | -]
  [-g group name | #gid] [-p prompt] [-u user name | #uid] file ...
...

 -A
    Normally, if sudo requires a password, it will read it from the 
    user's terminal. If the -A (askpass) option is specified

-A is ask for password, and not add a user to the sudoer's group. It appears none of -AknS adds a user to the group.

sudoedit -u <useranme> just prints help, and does not add the user to the sudoer's group.

How do we add a user to the sudoer's group?

A related question is How can I add a regular user to the sudoers file?. But it states to edit /etc/sudoers directly, which the man pages don't tell me to do. (Plus, I've learned that the BSDs are different enough from Linux so that we should not blindly follow Linux advice).

Improve this question

2 Answers 2

Reset to default
1

-A is ask for password, and not add a user to the sudoer's group. It appears none of -AknS adds a user to the group.

How do we add a user to the sudoer's group?

Okay, so the first thing is, there is no "sudoers group". (Well, not a default/dedicated one anyway, though it is actually common to configure %wheel or %staff as such a group.)

And if there were, you'd use usermod on OpenBSD (or gpasswd on Linux) – it's just a regular group modified using regular tools, there is nothing very sudo-ish about it.

The second thing is, sudoedit is not for modifying groups, it's for editing /etc/sudoers.

The manual pages tell you not to edit /etc/sudoers directly. But editing /etc/sudoers is exactly how you give sudo access to someone (whether a user or a %group).

The only difference is that sudoedit performs syntax checks on the edited file, so that you don't accidentally lock out all administrators because of a typo, and makes sure two people aren't editing the same sudoers file at the same time.. Regular vi /etc/sudoers wouldn't have such safeguards.

So the instructions remain the same. Run sudoedit – just sudoedit – and add your username or chosen group to the sudoers file.

Improve this answer
4
  • "Okay, so the first thing is, there is no "sudoers group" - that's kind of interesting. When I run, say, sudo gmake install, I get a message that I'm not in the sudoer's group. (And I did not install sudo; its part of the base system).
    – jww
    Jun 8, 2015 at 5:20
  • OK, so I elevated with su - and ran sudoedit username. The file appears to be filled with tilde's (~). I tried saving it with X-S X-C, but it does not appear to have any effect. So I killed the process. This is one of those times I really despise testing software on multiple platforms....
    – jww
    Jun 8, 2015 at 5:24
  • 1
    X-S X-C has no effect because you're looking at vi, not emacs – the tildes are just what vi shows below the end of the file. Perhaps your $EDITOR did not carry over through 'su'.
    – u1686_grawity
    Jun 8, 2015 at 5:26
  • Oh, thanks grawity. I don't use Vi; I use Emacs. I don't even know how to exit from Vi. Maybe that's why I had to kill the process...
    – jww
    Jun 8, 2015 at 5:30
2

The file /etc/sudoers describes which user may execute what using sudo.

But sudoedit is not the command to edit the /etc/sudoers. sudoedit is used to edit a file as another user.

To edit /etc/sudoers you need visudo(8).

If you are using OpenBSD-current, you might consider to use the new doas(1) instead of sudo - it is easier to configure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .