Use sudoedit to add user to sudo group?

Question

According to the OpenBSD FAQ #10:

If you want to give access to superuser privileges without adding users to the wheel group, use sudo(8).

According to the OpenBSD man pages on sudo(8):

sudoedit  [-AnS] [-a auth_type] [-C fd] [-c class | -]
  [-g group name | #gid] [-p prompt] [-u user name | #uid] file ...
...

 -A
    Normally, if sudo requires a password, it will read it from the 
    user's terminal. If the -A (askpass) option is specified

-A is ask for password, and not add a user to the sudoer's group. It appears none of -AknS adds a user to the group.

sudoedit -u <useranme> just prints help, and does not add the user to the sudoer's group.

How do we add a user to the sudoer's group?

---

A related question is How can I add a regular user to the sudoers file?. But it states to edit /etc/sudoers directly, which the man pages don't tell me to do. (Plus, I've learned that the BSDs are different enough from Linux so that we should not blindly follow Linux advice).

Answer 1

-A is ask for password, and not add a user to the sudoer's group. It appears none of -AknS adds a user to the group.

How do we add a user to the sudoer's group?

Okay, so the first thing is, there is no "sudoers group". (Well, not a default/dedicated one anyway, though it is actually common to configure %wheel or %staff as such a group.)

And if there were, you'd use usermod on OpenBSD (or gpasswd on Linux) – it's just a regular group modified using regular tools, there is nothing very sudo-ish about it.

The second thing is, sudoedit is not for modifying groups, it's for editing /etc/sudoers.

The manual pages tell you not to edit /etc/sudoers directly. But editing /etc/sudoers is exactly how you give sudo access to someone (whether a user or a %group).

The only difference is that sudoedit performs syntax checks on the edited file, so that you don't accidentally lock out all administrators because of a typo, and makes sure two people aren't editing the same sudoers file at the same time.. Regular vi /etc/sudoers wouldn't have such safeguards.

---

So the instructions remain the same. Run sudoedit – just sudoedit – and add your username or chosen group to the sudoers file.

Answer 2

The file /etc/sudoers describes which user may execute what using sudo.

But sudoedit is not the command to edit the /etc/sudoers. sudoedit is used to edit a file as another user.

To edit /etc/sudoers you need visudo(8).

If you are using OpenBSD-current, you might consider to use the new doas(1) instead of sudo - it is easier to configure.