RHCSA Practical Lab Series – Configuring Passwordless Sudo Access

🔍 Lab 15: Granting a User Group Sudo Privileges Without a Password

📌 Objective

In this lab, you will:

✔ Allow members of a specific user group (adminops) to use sudo without a password
✔ Modify the sudoers file using visudo
✔ Verify that the configuration works correctly

📌 Step 1: Open and Edit the sudoers File

🔹 Launch the visudo editor to safely edit sudo configurations:

[root@node1 ~]# visudo

📌 Why use visudo?

• It prevents syntax errors that could lock you out of administrative access.
• It validates changes before applying them.

✅ Locate the following line in the editor:

## Allow members of group wheel to execute any command
%wheel  ALL=(ALL)       ALL

🔹 Add a new line to grant passwordless sudo access to adminops:

%adminops  ALL=(ALL)  NOPASSWD: ALL

📌 Explanation:

• %adminops → Applies to all users in the adminops group.
• ALL=(ALL) → Grants full administrative privileges.
• NOPASSWD: ALL → Allows sudo without requiring a password.

✅ Save and exit the editor (Ctrl+X, then Y and Enter).

📌 Step 2: Create the adminops Group and Add Users

🔹 Create the group if it doesn't already exist:

[root@node1 ~]# groupadd adminops

🔹 Add users (alex, jordan, sam) to the group:

[root@node1 ~]# usermod -aG adminops alex
[root@node1 ~]# usermod -aG adminops jordan
[root@node1 ~]# usermod -aG adminops sam

📌 Explanation:

• -aG → Appends the user to an additional group (adminops).

✅ Verify group membership:

[root@node1 ~]# id alex

🔹 Expected Output:

uid=1002(alex) gid=1002(alex) groups=1002(alex),1003(adminops)

✅ If adminops appears, the user is successfully added.

📌 Step 3: Verify Passwordless Sudo Access

🔹 Switch to a user in the adminops group:

[root@node1 ~]# su - alex

🔹 Run a privileged command using sudo:

[alex@node1 ~]$ sudo cat /etc/shadow

📌 Expected Output:

root:$6$abcdefg123$xyzhashedpassword:18793:0:99999:7:::
...

✅ If the command executes without prompting for a password, the setup is successful!

📌 Step 4: Troubleshooting & Validation

🔹 If prompted for a password, recheck the sudoers file:

[root@node1 ~]# cat /etc/sudoers | grep adminops

🔹 Ensure the line is correctly formatted:

%adminops  ALL=(ALL)  NOPASSWD: ALL

🔹 If a user is denied sudo access, check their group membership:

[root@node1 ~]# id alex

✅ Reboot the system and confirm the settings persist after restart:

[root@node1 ~]# reboot

✅ Final Summary

✔ Configured passwordless sudo access for the adminops group
✔ Added specific users (alex, jordan, sam) to the group
✔ Verified that users can run sudo commands without a password
✔ Ensured changes persist across reboots

📌 Next Lab: Resetting the Root Password in RHEL 9

📩 Subscribe for more RHCSA exam labs and hands-on tutorials! 🚀