Exercise: accounts and sudo delegation

Tasks

1. Create trainee (home, bash, secondary group devs), password Passw0rd!.
2. Expiry: 60 days max, 7 days min, 10-day warning.
3. Force a password change at first login.
4. Allow trainee to run only systemctl restart httpd via sudo, without a password.
5. Verify with sudo -l -U trainee.

Verify

id trainee
chage -l trainee | head -4      # 60 / 7 / 10
sudo -l -U trainee              # NOPASSWD: /usr/bin/systemctl restart httpd

Solution

sudo groupadd -f devs
sudo useradd -m -s /bin/bash -G devs trainee
echo 'trainee:Passw0rd!' | sudo chpasswd
sudo chage -M 60 -m 7 -W 10 trainee
sudo chage -d 0 trainee
echo 'trainee ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd' | \
  sudo tee /etc/sudoers.d/trainee
sudo chmod 440 /etc/sudoers.d/trainee
sudo visudo -c