How to List Sudoer Rules Across All Mac and Linux Devices
Using Kolide, you can easily view and query Sudoer Rules across your fleet.
Introduction
sudo is a tool allowing certain users the ability to run commands
with additional permissions. It is commonly used to so that
administrators can run commands as root using their own
password.
What Sudoer Rule Data Can Kolide Collect?
Kolide's endpoint agent bundles in osquery to efficiently collect Sudoer Rules from Mac and Linux devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.
Kolide meticulously documents every piece of data returned so you can understand the results.
Sudoer Rules Schema
| Column | Type | Description | |
|---|---|---|---|
| id | Primary Key |
Unique identifier for the object |
|
| device_id | Foreign Key |
Device associated with the entry |
|
| device_name | Text |
Display name of the device associated with the entry |
|
| header | Text |
The first token of the rule: the user (eg. |
|
| rule_details | Text |
The remainder of the rule, eg. |
|
| collected_at | Timestamp |
Time the row of data was first collected in the database |
|
| updated_at | Timestamp |
Time the row of data was last changed in the database |
|
Why Should I Collect Sudoer Rules?
Regular review and audit of sudoers configuration is important for IT and Security teams to ensure that the additional permissions granted by sudo meet the organizations security policy. A misconfigured device may allow an attacker to escalate their permissions, or create a persistent backdoor.
End-User Privacy Consideration
Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.
Because sudo can be used by end-users in a totally customizable way, it is possible that one could add entries which contain sensitive or suggestive information. For example, one might configure a sudo rule to allow their partner privileged access to part of the computer. Likewise, one might configure sudo to allow access to a commonly used terminal command without needing a password.
When you use Kolide to list Sudoer Rule data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.
