Script Reloads Sudo Users Without Reboot: Solving Failed restart of sudo.service

Script Reloads Sudo Users Without Reboot: Solving Failed restart sudoservice

This article describes a script designed to solve the problem of reloading sudo users without requiring a reboot. Specifically, it addresses the issue where the sudo service fails to restart, which can prevent newly added sudo users from immediately accessing sudo commands on a Unix/Linux system. The article covers key concepts related to sudoers, user groups, and the implementation of the script.

Context and Problem Description

Sudo (SUperuser DO) is a powerful tool allowing administrators to grant specific users or groups with controlled access to administrative commands. Normally, changes made to the /etc/sudoers or /etc/group require a full system reboot for them to take effect. However, rebooting production systems isn't always viable, making it necessary to reload the sudo service or groups without rebooting. Unfortunately, the sudo service restart may fail due to various reasons, rendering the new configurations ineffective and prompting the need for a straightforward solution.

Key Concepts

Understanding the following concepts is essential for implementing a solution to the discussed problem:

• /etc/sudoers: The sudoers file is a configuration file determining user rights when using sudo.
• /etc/group: The group file details system group definitions as in the format group_name:x:GID:group_members.
• Sudoers visudo: It is a safer way to edit the /etc/sudoers file, provided with every sudo installation, which checks the file for syntax errors using a special version of the vi editor.
• PAM (Pluggable Authentication Modules): System-wide authentication management in Linux.

Solution Implementation

The following script can be used to reload the sudo users' configurations without requiring a reboot:

#!/bin/bash
# Script Reloads Sudo Users Without Reboot: Solving Failed restart sudoservice

## Config variables
TMP_USER_FILE=/tmp/user_tmp
TMP_GROUP_FILE=/tmp/group_tmp

## Get user details
grep '^sudo:' /etc/group | awk '{ print $3 }' > ${TMP_USER_FILE}
grep '^sudo:' /etc/group | awk '{ print $4 }' >> ${TMP_USER_FILE}

 sed -i 's/:/,/g' ${TMP_USER_FILE}

## Get group details
grep '^sudo:' /etc/group | awk '{ print $1 }' > ${TMP_GROUP_FILE}
sed -i 's/^sudo://g' ${TMP_GROUP_FILE}

## Create Files required for pam
touch /etc/security/pam_group_file
touch /etc/security/pam_user_file

## Add entries to pam_user_file
echo "Adding users to pam_user_file"
while IFS= read -r user; do
  echo ${user} >> /etc/security/pam_user_file
done < ${TMP_USER_FILE}

## Add entries to pam_group_file
echo "Adding groups to pam_group_file"
while IFS= read -r group; do
  echo ${group} >> /etc/security/pam_group_file
done < ${TMP_GROUP_FILE}

## Configure sudo visudo
echo "Configuring sudo visudo to utilize new users and groups"
cat /etc/sudoers | sed '/^#includedir/s/^#//' > /etc/sudoers.tmp
echo "## Generated by script to avoid reboot. NOT recommended for editing manually" >> /etc/sudoers
echo "%/etc/security/pam_group_file ALL=(ALL) ALL" >> /etc/sudoers

 
## Clean up
 
rm -f ${TMP_USER_FILE}
rm -f ${TMP_GROUP_FILE}
rm -f /etc/sudoers.tmp

Script Explanation

• TMP_USER_FILE and TMP_GROUP_FILE variables store the temporary user and group files respective.
• grep '^sudo:' /etc/group | awk '{ print ... }' fetches relevant user and group information for the sudo group.
• sed -i 's/:/r/g' converts group's members in the format of username:x:gid: to delimited by commas.
• touch /etc/security/pam_group_file and touch /etc/security/pam_user_file create files to be utilized by PAM.
• The while-loop while IFS= read -r user; and while IFS= read -r group; adds users and groups from the temp files into the new /etc/security/pam_ files.
• echo "## Generated..." adds a comment block in the /etc/sudoers file, informing about the script's changes.
• %/etc/security/pam_group_file ALL=(ALL) ALL grants sudo access to the dynamic sudo group.
• rm -f ... removes temporary files after completion.

Testing Script Functionality

To test, implement the script on a Linux system and execute it by calling sudo bash script_name.sh. Afterward, check group and user lists in the /etc/security/pam_ files to validate the correct additions. To validate sudo access, add a test user to the sudo group in the /etc/group and execute a command with elevated permissions.

• Linux and Unix systems typically require a reboot for sudoers or user group modifications to take effect.
• The script presented in this article allows reloading the sudo users' configurations without requiring a reboot, addressing the failure of a sudo service restart.
• Understanding Key Concepts such as /etc/sudoers, /etc/group, sudoers visudo, and PAM is essential for effective implementation.

References

• man sudoers
• sudo.ws sudoers
• Sed: A stream editor for filtering and transforming text