Becoming root with sudo

Why not just log in as root?

root can do anything: read every file, delete the whole system, add users. One typo as root can wreck a server, and if an attacker gets your session they get everything. So you work as a normal user and borrow root's powers only for the commands that need them, with sudo (superuser do).

head -n 2 /etc/shadow
sudo head -n 2 /etc/shadow

In the terminal

student@vulntech:~$ head -n 2 /etc/shadow
head: cannot open '/etc/shadow' for reading: Permission denied
student@vulntech:~$ sudo head -n 2 /etc/shadow
[sudo] password for student:
root:!*::0:::::
bin:!::0:::::

The password prompt

sudo asks for your own password, not root's. On this practice machine it's student. Nothing appears while you type, not even stars: that's normal. Press Enter when you're done.

After that, sudo remembers you for a few minutes and doesn't ask again:

sudo whoami
whoami

In the terminal

student@vulntech:~$ sudo whoami
[sudo] password for student:
root
student@vulntech:~$ whoami
student

Tip: Forgot sudo? sudo !! runs the previous command again with sudo in front (!! means the last command).

head -n 1 /etc/shadow
sudo !!

In the terminal

student@vulntech:~$ head -n 1 /etc/shadow
head: cannot open '/etc/shadow' for reading: Permission denied
student@vulntech:~$ sudo !!
sudo head -n 1 /etc/shadow
[sudo] password for student:
root:!*::0:::::

A root shell: sudo -i

For a series of admin commands, sudo -i opens a shell as root. The prompt ends in # instead of $, as a warning. exit takes you back:

sudo -i
whoami
pwd
exit
whoami

In the terminal

student@vulntech:~$ sudo -i
[sudo] password for student:
root@vulntech:~# whoami
root
root@vulntech:~# pwd
/root
root@vulntech:~# exit
logout
student@vulntech:~$ whoami
student

Who may use sudo?

Only users that the sudo settings (/etc/sudoers) allow. On Ubuntu, and on this machine, that's the members of the sudo group (other systems call it wheel). sudo -l shows what you may do:

sudo -l

In the terminal

student@vulntech:~$ sudo -l
[sudo] password for student:
Matching Defaults entries for student on vulntech:

    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    lecture=never

Runas and Command-specific defaults for student:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User student may run the following commands on vulntech:
    (ALL : ALL) ALL

(ALL : ALL) ALL means: as any user, any group, any command.

Common mistake: Don't put sudo in front of everything "just in case". Files you create with sudo belong to root, and a mistake made as root can't be stopped by permissions. Use it only when a command really needs it.

Tip: Edit the sudo settings only with sudo visudo. It checks the file before saving: a typo in /etc/sudoers could lock everyone out of sudo.

Remember: sudo command runs one command as root and asks for your password. sudo -i opens a root shell, exit leaves it, sudo -l shows what you may do.