Sudo in Policies
A policy can give its sessions sudo for a limited time. This is on top of the account's own rights. The account does not need sudo on the machine.
Set Sudo on a Policy
Open Policies in the PAM sidebar. Click New policy, or Edit on an existing one. Go to the Sudo part. See Policies.
| Sudo | Effect |
|---|---|
| None | No elevation. The session has only the account's own rights |
| Full sudo | The session may run any command with sudo |
| Specific commands | The session may run only the commands you list with sudo |
For Specific commands, enter one absolute path per line, optionally with arguments:
/usr/bin/systemctl restart nginx
/usr/bin/journalctl
A bare path allows any arguments.
For Full sudo and Specific commands, set a Time limit between 5 and 720 minutes. The default is 60 minutes.
When Sudo Applies
Sudo applies only to sessions approved with MFA. Set the policy's Action to Require approval.
A policy whose action is Allow without approval lets sessions in without MFA. Those sessions are not elevated. A Deny policy refuses its sessions, so its sudo never applies.
When Sudo Is Removed
Sudo is removed when either happens first:
- the session ends, or
- the time limit runs out.
Changing the policy also takes effect at once. Edit, Suspend or Delete removes the sudo from live sessions.
Related
- Policies: the full policy form.
- Add a User: create the account a policy names.
- Connect through a gateway