SUDO Controls requires:

  • Korn shell
  • Perl (a recent v5 will do)
  • SSH client + server (on both SSH master & client hosts). SFTP must be allowed on all client hosts.
  • SUDO (on client hosts)

SUDO Controls consists of:

  • A set of master configuration files (aka the SUDO Controls master repository):
    • grants: defines which SUDO rules should be configured where (i.e. target host)
    • alias: defines aliases (aka groupings) for hosts, SUDO rules or other groups. These aliases may be referenced in the grants file.
    • targets: defines the list to which SUDO Controls files should be distributed.
    • fragments (file) / fragments.d (directory): can be either of
      • A file containing a pre-defined list of SUDO rules (cfr. /etc/sudoers)
      • A directory containing a pre-defined list of SUDO rules organized in different files (cfr. /etc/sudoers.d)
  • A set of management scripts:
    • script to locally update & control the SUDO sudoers.d files
    • script to distribute the SUDO controls files, verify the SUDO syntax or to trigger the script remotely.
  • A correct working environment:
    • A working SSH login for each of the client hosts. You can use SSH Controls for this purpose.
    • A running SSH agent that will propagate the maintainer’s private key to each of the client hosts upon remote access/control (see also the Master to slave operations topic for more information on this).
    • Pre-configured SUDO rules to allow the update of SUDO controls on each of the client hosts (chicken-and-the-egg!).