How to: Limit Who Can Use sudo
#### Why

sudo lets accounts run commands as other accounts, including **root**. We want to make sure that only the accounts we want can use sudo.

#### Goals

- sudo privileges limited to those who are in a group we specify

#### Notes

- Your installation may have already done this, or may already have a special group intended for this purpose so check first.
  - Debian creates the sudo group. To view users that are part of this group (thus have sudo privileges):
	  
	  ```
	  cat /etc/group | grep "sudo"
	  ```
  - RedHat creates the wheel group
- See [https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/39](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server/issues/39) for a note on some distributions making it so `sudo` does not require a password. Thanks to [sbrl](https://github.com/sbrl) for sharing.

#### Steps

1. Create a group:

    ``` bash
    sudo groupadd sudousers
    ```

1. Add account(s) to the group:

    ``` bash
    sudo usermod -a -G sudousers user1
    sudo usermod -a -G sudousers user2
    sudo usermod -a -G sudousers  ...
    ```

    You'll need to do this for every account on your server that needs sudo privileges.

1. Make a backup of the sudo's configuration file `/etc/sudoers`:

    ``` bash
    sudo cp --archive /etc/sudoers /etc/sudoers-COPY-$(date +"%Y%m%d%H%M%S")
    ```

1. Edit sudo's configuration file `/etc/sudoers`:

    ``` bash
    sudo visudo
    ```

1. Tell sudo to only allow users in the `sudousers` group to use sudo by adding this line if it is not already there:

    ```
    %sudousers   ALL=(ALL:ALL) ALL
    ```

([Table of Contents](#table-of-contents))