The page provides tips on using thesudo command-line utility, managing thesudoers plugin, and preventing or fixing issues that arise.

Causes of problems

During each execution of thesudo command, the following process takes placeto validate thesudoers files:

• The syntax is checked for correctness.
• The content is analyzed to exclude some of the logical errors.
• Ownership and permissions are checked.

The validation of thesudoers files might fail due to any of the followingerrors:

user   ALL=(ALL) ALL

user   ALL=(ALL), ALL

$ sudo useradd username/etc/sudoers:20:17: syntax erroruser   ALL=(ALL), ALL                ^

barbara   ALL=(ALL:ALL) /usr/bin/ls

barbara   ALL=(4LL:ALL) /usr/bin/ls               ^barbara   ALL=(ALL;ALL) /usr/bin/ls                  ^bar6ara   ALL=(ALL:ALL) /usr/bin/1s   ^                             ^

$ ls -l /etc/sudoers-r--r----- 1 root root 700 Jan 1 12:00 /etc/sudoers$ sudo useradd username

$ ls -l /etc/sudoers-r--r---w- 1 root root 700 Jan 1 12:00 /etc/sudoers$ sudo useradd usernamesudo: /etc/sudoers is world writablesudo: no valid sudoers sources found, quittingsudo: error initializing audit plugin sudoers_audit

$ ls -l /etc/sudoers-r--r----- 1 user user 700 Jan 1 12:00 /etc/sudoers$ sudo useradd usernamesudo: /etc/sudoers is owned by uid 1000, should be 0sudo: no valid sudoers sources found, quittingsudo: error initializing audit plugin sudoers_audit

For more information about the configuration of thesudoers files, readSudoers Manual.

To learn how to manage and use thevisudo editor, readVisudo Manual.

Consequences of problems

Issues in thesudoers files cause negative effects and can affect thefunctionality of the entire system.

• Thesudo command no longer works.

  This is the most noticeable consequence of issues in thesudoers files.The consequence of this is the inability to use elevated privileges forusers, which blocks their activity on the server.

  However, more destructive and unpredictable consequences are failures of theapplications that rely on thesudo command. In some cases, this may causethe application to fail completely, leading to unexpected behavior, crashes,or data loss. Another example is when thesudo command is called by anapplication during the OS boot sequence and fails. It can lead to OS failureor cause the boot sequence to get stuck.

  Tip: If there is some kind of problem with thesudoers files, westrongly recommended that you stop the workload on the virtual machine (VM)instance, if possible, until the problem is fixed. This can be done in anumber of ways, including the following:
  • Temporarily disabling the startup or shutdown scripts.
  • Pausing thecron jobs.

• Possible unauthorized access to the system.

  Another risky consequence is that issues in thesudoers files can lead tounauthorized access to the system. This can happen due to a logical error,when rules in thesudoers files give some users or groups excessivepermissions.

  This may also happen because the system owner temporarily disables orweakens the system's defenses in order to log in and fix the problem.

  Tip: In order to avoid unauthorized access it is recommended to carefullyread the official documentation before editing thesudoers files.Additionally, during the recovery process, we highly recommended that youdon't use unsafe approaches such as the following:
  • Temporarily setting the password of theroot user through the startup script.
  • Creating a temporary user with administrator rights and the permissions to log in without a password.

Recovery in case of problems

If you lose elevated user privileges or can't use thesudo command due toproblems with thesudoers files, then use the superuser account for recovery.

In Unix-like operating systems, the superuser is a special user account with IDequal to 0, that is usually calledroot. The superuser has full access to thesystem resources, and can perform any administrative task without restrictions.While interacting with the OS on behalf of the superuser is generally consideredinsecure, it may be the only option for certain tasks such as recovery of thesudoers files.

Logging in directly as the superuser exposes the OS to risk. To avoid this risk,Google recommends that you use a startup script functionality, as this script isexecuted on behalf of the superuser.

Read more about Compute Enginestartup scripts.

To recover thesudoers files with a startup script, do the following:

1. Create a backup copy of the current startup script if it's already in use.The backup approach depends on how the startup script is configured.

   startup-script

   If the script content is set directly in the metadata value, you cancopy the script content to theCloud Storage bucket,local file or any other temporary private storage.

   Caution: Use only trusted storage so that the script doesn't leak duringthe recovery process.

   startup-script-url

   If the contents of the script are already in the remote storage and itsURL address is used, then you can just temporary remove thestartup-script-url metadata key to disable the current startup script.

   Caution: Do not remove the script file itself from the remote storage.

2. Update the startup scriptwith the following command sequence:

   mv /etc/sudoers /etc/sudoers.backup.$(date +"%s") && echo "%google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers && chown 0:0 /etc/sudoers && chmod 0440 /etc/sudoers

   Read more about what the commands does

   mv /etc/sudoers /etc/sudoers.backup.$(date +"%s")

   This command creates a copy of the/etc/sudoers file with a different name and deletes the original file. The name of the new file contains a timestamp at the end for uniqueness (e.g.sudoers.backup.1672527600).

   echo "%google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers

   This command creates previously deleted file/etc/sudoers with a single rule that allows authorized Google Cloud users with access to the VM to execute any commands on behalf of any system user. This rule always exists by default in an additional file/etc/sudoers.d/google_sudoers.

   chown 0:0 /etc/sudoers

   This command sets the owner of the/etc/sudoers file to a user whose ID is0 and a group of owners to a group whose ID is0.

   chmod 0440 /etc/sudoers

   This command sets permissions for the/etc/sudoers file to read-only and allows only its owner and owner group to read the file.

   Note: After these manipulations, the/etc/sudoers file can still be modified by authorized users of the system using thevisudo utility.

3. Stop the VM, if it's running. Restart the VM totrigger the execution of the startup script.

4. Сonnect to the VM and edit thebrokensudoers file to recover it.

   sudovisudo/etc/sudoers.backup.TIMESTAMP

   Note: Instead of fixing thesudoers file manually, you cancreate a new VM instance with thesame boot disk image and copy the correct file from there.

5. Save the changes and replace the current/etc/sudoers file with the fileyou just edited.

   sudomv/etc/sudoers.backup.TIMESTAMP/etc/sudoers

6. Make sure that the original issue with using thesudo command and elevatedprivileges has been fixed.

7. Remove the temporary startup script and restore the original one if it wasused.

   Note: If the temporary startup script remains, the content of the/etc/sudoers file is overwritten each time the VM is restarted.

What's Next?

• Learn how torecover an inaccessible or corrupted VM.
• Learn how toadd an existing disk to another VM.