[CentOS] Giving full administrator privileges through sudo on production systems

Fri Aug 16 05:04:29 UTC 2019
Bagas Sanjaya <bagasdotme at gmail.com>

Hello,

Consider two following cases:

1. On production systems on television stations, a sysadmin give teens 
(remaja group, age 13 and older) full administrator privileges by adding 
this line to sudoers:

%remaja ALL=(ALL:ALL) ALL

Rationale: Almost all programs on the system can only be run by teens as 
root.

2. On production systems on tobacco factories, a sysadmin also give 
adults (age 18 and older, dewasa group) full administrator privileges by 
adding this line to sudoers:

%dewasa ALL=(ALL:ALL) ALL

Also, the sudo lecture file configured in sudoers (/etc/sudo.lecture) 
contain the following:

WARNING: I BROKE MY SYSTEM BECAUSE OF SUDO. CUSTOMER SERVICE: 
($a_random_phone_number)

Rationale: All programs on system can only be run by adults, because 
such programs might break system. However, instead of calling sysadmin 
when something breaks the system, adults can call customer service 
instead, which isn't qualified for system maintenance.

Based on above cases, is it OK to give group of random users full 
administrator privileges using sudo, by adding them to sudoers with ALL 
privileges? Should sudoers call customer service number instead of 
sysadmin when something breaks?

Cheers, Bagas

-- 
An old man doll... just what I always wanted! - Clara