#############################################################
# /opt/sudo/conf/sudoers:  sudo permissions file
#
# Change Log:
# Who  When        What
# ---- ----------  ----------------------------------------------
#
#
##############################
## User alias specification ##
##############################
# Defines shorthand names for users and groups using names
#   from /etc/passwd and /etc/group
#   Format: User_Alias <sudo alias> = 
#			<group in /etc/groups> |
#			<user in /etc/passwd>[, <user in /etc/passwd>] |
#			<user in /etc/passwd>[, <group in /etc/group>]
#
# Outside of scope of this paper: It is also possible to use NIS/LDAP
#	users and groups.
##
# Create the single user "notroot" as User_Alias "APPOWNER"
User_Alias	APPOWNER = notroot
# Use the Group "staff" to define User_Alias "ADMINS"
User_Alias      ADMINS = %staff
# Alternatively, define User_Alias "ADMINS" with individual user IDs
# User_Alias      ADMINS = bob,chuck,steve
# Here is an example mixing users and groups (suppose that
#	"bob" was not a member of %staff)
# User_Alias      ADMINS = bob,%staff

###############################
## Runas alias specification ##
###############################
# Defines shorthand names for IDs under which sudo'd programs
#       will run; uses names from /etc/passwd, and default is "root"
# Can optionally include Group IDs from /etc/group to provide a Group context
# You can specify multiple Runas aliases and then use them
#	to give different user and/or group contexts to commands
#	executed via sudo
#   Format: Runas_Alias <sudo alias> = <user in /etc/passwd>[,<group in /etc/group>[,<group in /etc/group>]]
##
# This Runas alias, "OVERLORD", is redundant, but is shown for
#	the sake of explicitness
Runas_Alias     OVERLORD = root
# This Runas alias would cause commands run under its auspices
#	to execute with the same permissions as an unprivileged
#	sendmail instance
Runas_Alias	MAILSYS = smmsp,smmsp

##############################
## Host alias specification ##
##############################
# Defines a shorthand for the hosts on which commands can be
#      run. Running commands on other hosts would required rsh
#      or other remote execution functionality
#   Format: Host_Alias <sudo alias> = <host's fully-qualified domain name or short name>
##
Host_Alias      HOST = host.domain.tld

##############################
## Cmnd alias specification ##
##############################
# Defines shorthand specs for various commands
# Commands may contain parameters (it is necessary to escape some
#	characters in parameter)
# Multiple commands may be specified per Cmnd_Alias, separated by
#	commas; a \ is the line-continuation character
#   Format: Cmnd_Alias <sudo alias> = <full path specification of program [any parameters]>

# Command necessary to make/restore backups and operate tape drive
Cmnd_Alias      TAPE = /usr/sbin/ufsdump, /usr/sbin/ufsrestore, \
                  /usr/bin/mt

# System shutdown command
Cmnd_Alias      SHUTDOWN = /usr/sbin/shutdown

# Process kill command
Cmnd_Alias	KILL = /usr/bin/kill

# Super-user command
Cmnd_Alias      SU = /usr/bin/su

# Editor for this file
Cmnd_Alias      SUEDIT = /sbin/visudo

# syslogd management
Cmnd_Alias      SYSLOG = /etc/init.d/syslog, /usr/sbin/syslogd

# Sendmail in test mode
Cmnd_Alias	TESTSEND = /usr/lib/sendmail -bt

###############################
## Override builtin defaults ##
###############################
## Formats:
# Defaults<:optional list of users>  [whitespace]  <option>
##
# Turn off sudo's "lecture" for selected people
#Defaults:ADMINS    !lecture
Defaults:root      !lecture

# Enable visudo to honor the EDITOR environment variable
Defaults           env_editor

########################
## User specification ##
########################
# Definitions of who can do what
# If a Runas alias is not specified, "root" is assumed
# Format:
#       User_Alias = [ ( RunAs_Alias ) ] [ <default overrides>: ] Cmnd_Alias [, Cmnd_Alias]
##
# Staff may run  "visudo"
ADMINS		HOST = (OVERLORD) SUEDIT

# Staff may make/restore backups (as root)
# This entry demonstrates the "nopasswd" default
#	override
ADMINS		HOST = (OVERLORD) nopasswd:TAPE

# Staff may stop/start syslog (as root)
ADMINS		HOST = (OVERLORD) SYSLOG

# Staff may issue kill or shutdown commands
ADMINS		HOST = (OVERLORD) KILL, SHUTDOWN

# Staff may change any password except for that of root
ADMINS		HOST = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root

# The application owner may run sendmail in "test" mode
APPOWNER	HOST = (MAILSYS) TESTSEND

####################################
#### End /opt/sudo/conf/sudoers ####
####################################