Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been considering implementing using SSH keys for authentication, rather than passwords but I have concerns about the best way to implement sudo rights to users in that case.

I know a lot of people modify /etc/sudoers to have and set their needed users to NOPASSWD. But I see no mention of people giving their users passwords, so I have a hard time doing that. What if my box is owned as a non-privileged user, all it would take is a quick 'su user' into my NOPASSWD'd user and I'd be done for, in theory. Or worse yet, physical access and someone who knows my username.

Is it best practice to go ahead and set a password on those accounts, or are there some other mechanisms used such as preventing local logins or do people just set a password and throw it away/never use it?

2 Answers 2


The NOPASSWD option allows the sudo program to be executed by the sudo user without having to enter a password. It does not imply that your account is password-less.

Other users that run su youruser still need to enter the password for youruser. But if you are logged in as youruser (via physical access or over SSH), then you do not have to enter a password when you run sudo somecommand.


Like @Lekensteyn mentioned in his answer, the NOPASSWD directive in the /etc/sudoers file merely removes the need for the user to enter his password when executing the sudo command.

This has literally zero correlation to whether the user is ssh-ing into the box through passwords or ssh keys. Either way, if the user has ssh access into the box, and you allow him to execute to all commands or even just su through sudo in the /etc/sudoers file, he can escalate his privileges to root by simply running sudo su -.

The best practice of course, is to not let any old users run any old commands using sudo. Build a whitelist of commands that a specific user should be allowed to execute as root and allow him access to nothing else. You can easily (if a little tedious) setup various "administrator" groups with different sets of sudo privileges and assign said group to a specific user. Consult man sudoers for more information on specific configurations.

  • @Lekensteyn I have corrected NOPASSWD. See idioms.thefreedictionary.com/any+old+thing for the phrase "any old user". Sure, sudo can allow execution as any user, not just root but that's really not that relevant...
    – user10211
    Oct 6, 2013 at 9:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .