Gaining Privileges

System administrators, and in some cases users, need to perform certain tasks with administrative access. Accessing the system as the root user is potentially dangerous and can lead to widespread damage to the system and data. This chapter covers ways to gain administrative privileges using setuid programs such as su and sudo. These programs allow specific users to perform tasks which would normally be available only to the root user while maintaining a higher level of control and system security.

See the Red Hat Enterprise Linux 7 Security Guide for more information on administrative controls, potential dangers, and ways to prevent data loss resulting from improper use of privileged access.

The su Command

When a user executes the su command, they are prompted for the root password and, after authentication, are given a root shell prompt.

Once logged in using the su command, the user is the root user and has absolute administrative access to the system. Note that this access is still subject to the restrictions imposed by SELinux, if it is enabled. In addition, once a user has become root, it is possible for them to use the su command to change to any other user on the system without being prompted for a password.

Because this program is so powerful, administrators within an organization may want to limit who has access to the command.

One of the simplest ways to do this is to add users to the special administrative group called wheel. To do this, type the following command as root:

~]# usermod -a -G wheel username

In the previous command, replace username with the user name you want to add to the wheel group.

You can also use the Users settings tool to modify group memberships, as follows. Note that you need administrator privileges to perform this procedure.

  1. Presione la tecla Super para entrar en la Visión General de Actividades, teclee Usuarios y pulse la tecla Enter. Aparece la herramienta de ajustes de Usuarios. La tecla Super aparece de diversas formas, dependiendo del teclado y otro hardware pero con frecuencia es la tecla Windows o Command y normalmente está a la izquierda de la Barra Espaciadora.

  2. Para poder hacer cambios pulse el botón Desbloquear e introduzca una contraseña válida de administrador.

  3. Pulse el icono de un usuario en la columna izquierda para visualizar las propiedades del usuario en el panel de la derecha.

  4. Cambie el Tipo de Cuenta de Estandar a Administrador. Esto añadirá al usuario al grupo wheel.

Vea en Administrando Usuario en un Entorno Gráfico más información sobre la herramienta Usuarios.

Después de que haya añadido los usuarios deseados al grupo wheel, es aconsejable permitir que solo estos usuarios utilicen el comando su. Para hacer esto, edite el archivos de configuración PAM para su, /etc/pam.d/su. Abra este archivo en un editor de texto y descomente la siguiente línea quitando el carácter #:

#auth           required use_uid

This change means that only members of the administrative group wheel can switch to another user using the su command.


The root user is part of the wheel group by default.

The sudo Command

The sudo command offers another approach to giving users administrative access. When trusted users precede an administrative command with sudo, they are prompted for their own password. Then, when they have been authenticated and assuming that the command is permitted, the administrative command is executed as if they were the root user.

The basic format of the sudo command is as follows:

sudo command

In the above example, command would be replaced by a command normally reserved for the root user, such as mount.

The sudo command allows for a high degree of flexibility. For instance, only users listed in the /etc/sudoers configuration file are allowed to use the sudo command and the command is executed in the user’s shell, not a root shell. This means the root shell can be completely disabled as shown in the Red Hat Enterprise Linux 7 Security Guide.

Each successful authentication using the sudo command is logged to the file /var/log/messages and the command issued along with the issuer’s user name is logged to the file /var/log/secure. If additional logging is required, use the pam_tty_audit module to enable TTY auditing for specified users by adding the following line to your /etc/pam.d/system-auth file:

session required disable=pattern enable=pattern

where pattern represents a comma-separated listing of users with an optional use of globs. For example, the following configuration will enable TTY auditing for the root user and disable it for all other users:

session required disable=* enable=root

Another advantage of the sudo command is that an administrator can allow different users access to specific commands based on their needs.

Administrators wanting to edit the sudo configuration file, /etc/sudoers, should use the visudo command.

To give someone full administrative privileges, type visudo and add a line similar to the following in the user privilege specification section:

juan ALL=(ALL) ALL

This example states that the user, juan, can use sudo from any host and execute any command.

The example below illustrates the granularity possible when configuring sudo:

%users localhost=/sbin/shutdown -h now

This example states that any member of the users system group can issue the command /sbin/shutdown -h now as long as it is issued from the console.

The man page for sudoers has a detailed listing of options for this file.


There are several potential risks to keep in mind when using the sudo command. You can avoid them by editing the /etc/sudoers configuration file using visudo as described above. Leaving the /etc/sudoers file in its default state gives every user in the wheel group unlimited root access.

  • By default, sudo stores the sudoer’s password for a five minute timeout period. Any subsequent uses of the command during this period will not prompt the user for a password. This could be exploited by an attacker if the user leaves their workstation unattended and unlocked while still being logged in. This behavior can be changed by adding the following line to the /etc/sudoers file:

    Defaults    timestamp_timeout=value

    where value is the desired timeout length in minutes. Setting the value to 0 causes sudo to require a password every time.

  • If a sudoer’s account is compromised, an attacker can use sudo to open a new shell with administrative privileges:

    sudo /bin/bash

    Opening a new shell as root in this or similar fashion gives the attacker administrative access for a theoretically unlimited amount of time, bypassing the timeout period specified in the /etc/sudoers file and never requiring the attacker to input a password for sudo again until the newly opened session is closed.

Recursos Adicionales

While programs allowing users to gain administrative privileges are a potential security risk, security itself is beyond the scope of this particular book. You should therefore refer to the resources listed below for more information regarding security and privileged access.

Installed Documentation
  • su(1) — The manual page for su provides information regarding the options available with this command.

  • sudo(8) — The manual page for sudo includes a detailed description of this command and lists options available for customizing its behavior.

  • pam(8) — The manual page describing the use of Pluggable Authentication Modules (PAM) for Linux.

Online Documentation
See Also
  • Managing Users and Groups documents how to manage system users and groups in the graphical user interface and on the command line.