sudo and the rules folder

Permission to act as root

You have already typed sudo a few times. sudo lets a normal account run a single command as root, usually after typing a password. Who is allowed to use it, and whether they need a password, is decided by small rule files in the folder /etc/sudoers.d/.

Here is the normal rule on this machine — it says members of the sudo group may run anything, but must give a password:

sudo cat /etc/sudoers.d/sudo-group

In the terminal

student@vulntech:~$ sudo cat /etc/sudoers.d/sudo-group
[sudo] password for student:
Defaults lecture=never
%sudo ALL=(ALL:ALL) ALL

The danger phrase to look for is NOPASSWD. A rule with NOPASSWD: ALL lets an account become root instantly, with no password at all. If an attacker drops a file like that into the folder, they own the machine forever.

Tip: After an incident, list /etc/sudoers.d/ and read every file. Anything with NOPASSWD that you did not put there is a red flag.