Can I use the sudo command while logged into a standard account using an admin password?

Question

Can I use the sudo command while logged into a standard account using an admin password?

I have recently done a total clean reinstall of OS X Mavericks. When the machine first started up, I created my account like normal (which is an Administrator account). I don't like running in an Admin account all the time, so I created a "new" Administrator account called "Admin" and switched the account I originally created to a Standard account.

Now, I was trying to run a 'sudo' command in Terminal for creating a USB installer of Yosemite. When it asks me for my password, I input the password of the "new" Admin account, which I figured would work. It doesn't. When I log in to that "new" Admin account and run the command, it works fine. Or if I go in the "Users" in "Preferences" and check the box to "Allow user to administer this computer" on my Standard account and run the command again, it works.

So my question is, is this normal to only be able to use the 'sudo' command while logged in to an Administrator account? I would think that you could use the 'sudo' command in any account as long as you have an Administrator password.

Posted on Apr 22, 2015 7:24 PM

Reply

Answer 1

Best reply

Niel

Level 10

726,935 points

Apr 22, 2015 7:26 PM in response to FrozenInCarbonite

Yes, it is. Unless the sudoers configuration file has been changed, only administrator accounts will be allowed to use it.

(126556)

Reply

Answer 2

BobHarris

Level 9

53,147 points

Apr 22, 2015 7:41 PM in response to FrozenInCarbonite

By default, "No". Yes this is normal and how the sudo command works.

The user you are logged in as must be in the /etc/sudoers file, or a group that the current user belongs to is in the /etc/sudoers file (Admins belong to the group 'admin' which has an entry in /etc/sudoers).

If you decide to edit the /etc/sudoers file be VERY careful or you can prevent the admin from elevating their privileges.

But of course if you enter your non-admin user into the /etc/sudoers file, then the will be an admin, so you might as well either user the admin account or use System Preferences -> Users & Groups to give the non-admin account admin rights.

NOTE: The ONLY "REAL" difference between an admin account and a non-admin is the ability to use the sudo command. So if non-admins can use the sudo command, they they ARE admins.

You can use the 'su' command to become the admin account, and in this case you do need to know the admin account's password

su admin_account_name

Password: admin_account_password

...now you are the admin, but you do not have any magical privileges yet; you still need to execute sudo to get those...

sudo command needing privileges

Password admin_account_password

Reply

Answer 3

Apr 22, 2015 7:41 PM in response to Niel

Thanks Niel! I thought my system was messed up because I couldn't run 'sudo' in a Standard account, even when using my Admin password. Now I know!

Reply

Answer 4

Camelot

Level 9

54,333 points

Apr 22, 2015 10:40 PM in response to FrozenInCarbonite

I would think that you could use the 'sudo' command in any account as long as you have an Administrator password.

Think about that statement for a moment.

Any authentication action requires two (sometimes more, but we'll keep it simple) elements - a username and a password, and they must match what the authentication system expects.

When you run sudo on a command line, the only user it knows about is the current user you're logged in as.

You're suggesting that if you enter the password of *any* admin user on the system, sudo should somehow realize this and give you admin rights?

So now every time you enter an incorrect (for the current user) password, the auth system has to check every other account on the system just in case you really meant to run as an admin. That might not be a problem on a system with two accounts, but imagine a system connected to a corporate directory server with thousands, or tens of thousands of accounts. You want to check every one of those to see if your password matched? That actually sounds like an awesome brute-force password attack vector to me ("hey, does 'ABCDEFG" match the password for any user on this system? Cool!")

So, no - absolutely sudo wants the password of the current user.

Fortunately it's not as bad as having to log out and re-login with the admin account. You can use 'su' ('switch user') to switch to the admin account, then you can sudo as expected:

localhost:~ user$ su - admin

Password:

localhost:~ admin$ sudo /bin/blah -foo -bar

Reply