Sudo_privileges

Chapter 9: sudo and Privilege Escalation

Overview

This chapter covers sudo configuration and privilege escalation techniques for secure system administration.

---

9.1 Understanding sudo

sudo vs su

                      sudo vs su Flow
+------------------------------------------------------------------+
|                                                                   |
|   Using sudo:                                                    |
|   +---------+      +-------+      +-------------+                |
|   | Regular |----->| sudo  |----->|  Verify    |                |
|   |  User   |      |command|      |  /etc/sudoers              |
|   +---------+      +-------+      +-------------+                |
|                                         |                        |
|                                         v                        |
|                                  +-------------+                |
|                                  | Permission |                |
|                                  |   Check    |                |
|                                  +-------------+                |
|                                         |                        |
|                                         v                        |
|                                  +-------------+                |
|                                  |  Execute   |                |
|                                  |  Command   |               -------------+                |
 |
|                                  +|                                                                   |
|   Using su:                                                      |
|   +---------+      +-------+      +-------------+                |
|   | Regular |----->|  su -|----->|   Root     |                |
|   |  User   |      |       |      |  Password  |                |
|   +---------+      +-------+      +-------------+                |
|                                         |                        |
|                                         v                        |
|                                  +-------------+                |
|                                  |    Root   |                |
|                                  |   Shell   |                |
|                                  +-------------+                |
|                                                                   |
+------------------------------------------------------------------+

---

9.2 sudo Configuration

Basic sudo Usage current DNS configuration

cat /etc/resolv.conf

Example output:

nameserver 192.168.1.1

nameserver 8

# Run command as root
sudo command

# Run command as specific user
sudo -u username command

# Run command.8.8.8
# nameserver 1.1.1.1
# search example.com

4.6.2 resolv.conf Options

| Option | Description as root with environment sudo -i command

Edit file with root privileges

sudoedit /etc/file sudo - | Example | |--------|-------------|---------| | nameserver | DNS server IP | nameserver 8.8.8.8 | | search | Domain search liste /etc/file

### /etc/sudoers Configuration

```bash
# Basic sudoers file
# User | search example.com |
| options | Runtime options | options timeout:2 attempts:3 |

```bash
# /etc/resolv.conf example with privilege specification
username ALL=(ALL:ALL) ALL

# Group privilege specification
%groupname ALL=(ALL:ALL) ALL

# No password required
username ALL=(ALL) NOPASSWD: ALL

# Specific command only
username ALL=(ALL) options
nameserver 192.168.1.1
nameserver 8.8.8.8
nameserver 1.1.1.1
search local /usr/bin/systemctl restart nginx

---

9.3 Arch Linux sudo Setup

Installing and Configuring sudo

options timeout:2 attempts:3 rotate

4.6.3 systemd-resolved (

Install sudo (usually pre-installed)

sudo pacman -S sudo

Add user to wheel group

sudo usermod -aG wheel username

Arch Linux)

# Check systemd-resolved status
systemctl status systemd-resolved

# View resolved cache
resolvectl status

# Query using resolvectl
resolvectl query example.com

# Flush DNS cache
resolvectl flush-caches
systemd# Configure wheel group
sudo visudo
# Uncomment: %wheel ALL=(ALL) ALL

---

9.4 Privilege Escalation

Checking sudo Access

# Check your sudo privileges
sudo -l

# Check specific user's privileges
sudo -l -U username
-resolve --flush-caches

---

4.7 DNS Caching

4.7.1 DNS Cache

### Common sudo Commands

```bash
# System administration
sudo systemctl restart service
sudo systemctl status nginx
sudo journalctl -u service

# File operations
sudo cat /etc/shadow
sudo chmod 777 /path
sudo chown user:group /path

# Network operations?}
        Cache -->|Yes| Return[Return Cached IP]
        Cache -->|No| Query[Query DNS Server]
        Query --> Cache
sudo iptables -L
sudo netstat -tulpn

# Package management (Arch)
sudo pacman -S package
yay -S package  # If in sudoers
```

---

## 9.5 Security Best Practices

```bash
# Best practices for sudo

2[Cache Result]
        Cache2 --> Return
    end
```

### 4.7.2 Clear DNS Cache

```bash
# Systemd-resolved
sudo resolvectl flush-caches

# nscd (nscd)
sudo systemctl restart nscd

# B# 1. Use specific commands instead of ALL
username ALL=(ALL) /usr/bin/systemctl restart nginx

# 2. Use NOPASSWD sparingly
# Only for specific automated tasks
username ALL=(ALL) NOPASSWDIND/named
sudo rndc flush

# Clear browser DNS cache (Chrome)
chrome://net-internals/#dns
chrome://net-internals/#sockets
```

### 4.7.3 DNS Cache TTL

```bash
# Check TTL in dig output: /path/to/script.sh

# 3. Log all sudo usage
# In /etc/sudoers
Defaults logfile=/var/log/sudo.log

# 4. Require password for dangerous commands
username ALL=(ALL) /bin/rm, /bin
dig example.com

# Look for the TTL value
# example.com.    86400  IN  A  93.184.216.34
#/mkfs, /usr/bin/pacman -S*
```

---

## Summary

In this chapter, you learned                     ^^^^ TTL in seconds
```

---

## 4.8 Troubleshooting DNS

---

## Summary

This chapter covered:
- ✅ sudo vs su difference
- ✅ Basic sudo configuration
- ✅ /etc/sudoers syntax
- ✅ Arch Linux sudo setup
- ✅ Privilege escalation commands
- ✅ Security best practices

---

## Next Chapter

[Chapter 10: PAM and Authentication](./10_pam_authentication.md)

---

*Last Updated: February 2026*