2

I just installed the April 4th 2022 edition of Rasberry Pi OS and added a root password in addition to my user password. I also did..

deluser <userme> sudo

I tested my new security adjustment by using apt (without "sudo)" to install a package, and as I expected it wouldn't allow me (as regular user) to install the package, just as hoped. (I'm trying to tighten security, not disable security) Then I tested by prefixing "sudo" and to my surprise apt downloaded and installed my packages successfully, without even prompting for any password. I rechecked to see if I was listed in sudo groups and I wasn't. So I rebooted and tried again. sudo still worked without prompting for a password.

I researched and discovered I should edit the file /etc/sudoers.d/010_pi-nopasswd to force sudo to ask for a password, and now it does. I edited the critical line to read <user> ALL=(ALL) NOPASSWD: ALL I also went into the Desktop Pi settings and selected to prompt for my user password and each bootup, and it does that. So, the raspberry pi is asking for passwords, but I'm trying to get rid of sudo

I want to switch to root powers using the su command to do things like installing new software with apt. Currently, sudo still works just like before removing my user from the sudo groups with deluser <userme> sudo

Is that normal behavior for raspberry pi os to still use sudo even with my user removed from the sudo group ? I suppose I'm misunderstanding something about sudo

5
  • 2
    Raspberry Pi OS is Linux and works the same as any other Linux OS. The only unusual aspect is that NOPASSWD is enabled by default, but this can be set/disabled on any OS.
    – Milliways
    Jun 22 at 2:55
  • is the ability to use sudo, despite having run "deluser <userme> sudo" the normal behavior? I was expecting to not be able to use sudo in any form
    – user12711
    Jun 22 at 11:25
  • 2
    Unless you understand sudo I recommend you don't fiddle with it. In particular DO NOT purge sudo. Debian assumes sudo (which is recommended practice and does not use root). You risk making your system unusable. You haven't explained what you attempt to achieve. By all means remove passwordless sudo if it makes you happy but don't imagine this improves security.
    – Milliways
    Jun 22 at 13:29
  • Your question is a bit confusing. I assume you issued your command to remove userme from the group sudo as the root user? It's OK not to be explicit about that, but if you're not going to be explicit, I think it's customary to show the # prompt to let us know you were root for this command; i.e. # deluser <userme> sudo. Are you sure userme was removed from the sudo group?
    – Seamus
    Jun 22 at 13:30
  • Actually I don't remember if I was root user or not when I issued the command # deluser userme sudo # However, I'm doing a "groups userme" and "sudo" is not listed as a group that userme belongs to.
    – user12711
    Jun 22 at 14:51

2 Answers 2

2

If I'm following your explanation correctly, you issued the command deluser <userme> sudo as the root user. You also said, "I rechecked to see if I was listed in sudo groups", but you didn't say how you verified that.

I'll guess the reason that the deluser command you ran didn't get userme blocked from sudo access is rooted in the same issues addressed in this Q&A from Ubuntu SE. Here's some things to try/check:

  • Verify userme is not listed as a member of the group sudo in /etc/group. If deluser works as we assume it does, your listing should not show userme.

    $ cat /etc/group | grep sudo
    sudo:x:27:pi
    
    EDIT: Verified in comment
  • If userme is still listed as a member of group sudo, then I would suggest that you create a new regular user, and then delete userme - in that order.

Again, this is guesswork, if you have a password login for user root then you won't be locked out.

EDIT:

I don't know what your sudoers file looks like, so I'll make another assumption that the following lines are in your sudoers file (open this using sudo visudo) :

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "@include" directives:
@includedir /etc/sudoers.d

The first (uncommented) line beginning with %sudo is what allows any member of the sudo group to gain sudo privileges. If this line is in your sudoers file, comment it out; i.e.

# %sudo   ALL=(ALL:ALL) ALL

And just for good measure, comment out the line that begins with @includedir - that line is what causes the scripts under /etc/sudoers.d to run.

As long as you have a root login, reboot your system, and now try to sudo from userme. If you do not get sudo, this "proves" that userme's membership in group sudo survived the deluser removal. I don't know why yet, but there's a reason - it's only software after all :)

13
  • I checked to see if userme was removed from sudo group by issuing the command groups userme and the command results didn't list sudo among the various other groups in the list. I'm reading through the rest of your response just now.
    – user12711
    Jun 22 at 15:39
  • I just checked the contents of /etc/groups and the only entry for sudo reads sudo:x:27: (with no reference to userme) And, I grepped for userme and I'm listed in 15 groups but none with sudo in the line. I'm still reading the rest of your post
    – user12711
    Jun 22 at 15:47
  • The solution that I got to work was #adduser newuser it works as expected with newuser (it does not have sudo privileges, just as hoped)
    – user12711
    Jun 22 at 17:16
  • I'm reading through your EDIT going to give that a try with userme which I have not removed yet
    – user12711
    Jun 22 at 17:18
  • your new answer under EDIT also works!! (I had already commented out the %sudo ALL=(ALL:ALL) ALL using vim, but had not commented out @includedir /etc/sudoers.d at any rate, i went to check to see if I used the visudo utility correctly (and actually saved the file) by doing a sudo cat/etc/sudoers ..it asked for password, then said: * ...not in the sudoers file. This incident will be reported.* that's what I was looking for! the problem has been solved for userme now!
    – user12711
    Jun 22 at 17:33
1

There might still be an entry in the /etc/sudoers file.

If you don't want to use sudo I suggest you uninstall the package.

apt purge sudo

5
  • I'm just did a "sudo cat /etc/sudoers" and it lists: "root ALL=(ALL:ALL) ALL" there is also another line that reads: "%sudo ALL=(ALL:ALL) ALL" - - - looks like all users are given root powers through sudo, regardless of membership with the sudo group??? and that the sudo group is commented out??? I will try reversing that and see what happens
    – user12711
    Jun 22 at 11:35
  • actually, I shied away from commenting out the "root ALL=(ALL:ALL) ALL" line because I was afraid I would lose all root power to do anything; I'm still trying to learn what that line does. As for the "%sudo ALL=(ALL:ALL) ALL" that might not be a commented out line. On second look the pound symbol is being used as a comment. I did add a pound symbol to that line and the next time I used sudo it didn't ask for a password. I need to learn about that file and will post again after I gain more knowledge
    – user12711
    Jun 22 at 15:04
  • update, I commented out the line "%sudo ALL=(ALL:ALL) ALL" within the /etc/sudoers file. sudo still works with userme and asks for my password... I'm getting closer to doing an "apt purge sudo" but still researching how to eliminate sudo privileges for userme without removing sudo altogether
    – user12711
    Jun 22 at 15:32
  • @user12711: "I commented out the line "%sudo ALL=(ALL:ALL) ALL" within the /etc/sudoers file. sudo still works with userme and asks for my password"... Really!?!
    – Seamus
    Jun 23 at 9:11
  • Yes sudo was still working with userme after commenting out that line using Vim. I also used cat to double check the file to make sure the edit stuck, since that is read only file. It did. Problem solved now though using the advice in the other answer
    – user12711
    Jun 23 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.