sudo

Puppet module for configuring sudo. Not yet ready for production!

Table of Contents

1. Description
2. Todo
3. Usage - Configuration options and additional functionality
4. Example - Hiera example of sudo configuration

Description

Installs and configures sudo.

This modules can configure most features described in sudoers(5), both in one main files, and in separate files located in a includedir (/etc/sudoers.d)

Todo

There still remains some work to do before this can be used in production environments. Use this only for testing it. I appreciate suggestions for improvements (preferably by pull requests)

Since the most important method for controlling this module is with the quite complex hash $sudo::conf the datastructure needs to be documented a lot more. For now it's mainly documented by example.

The datastructure for $sudo::conf might also need some redesigning.

Usage

class { 'sudo': }

The main feature is located in a single hash provided to sudo as parameter conf. This is possible to specify either as class-parameter or hieradata.

The keys in $sudo::conf is what file to write configurations to, the special key '_sudoers' is used for the main sudo configuration file $sudo::sudoers (normally '/etc/sudoers'), other keys specifies files to create under $sudo::includedir (normally /etc/sudoers.d)

The value for $sudo::conf[file] can be one of:

• mode, the file permission mode for the file, default $sudo::defaultmode
• defaults, defaults specifications as described by sudoers(5)
• user_alias
• runas_alias
• host_alias
• cmnd_alias
• user_specs

Hiera example

sudo::conf:
  _sudoers:
    defaults:
      - Defaults:
          - insults

This will result in /etc/sudoers containing

## Managed by puppet class sudo
## Do not edit

# Override built-in defaults
Defaults insults

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

There is also a quite large example in HIERA_EXAMPLE.md based on the examples in sudoers(5), which will results in /etc/sudoers.d/example with content EXAMPLE.md

Reference

Table of Contents

Classes

Public Classes

• sudo: Installs and configures sudo

Private Classes

• sudo::config: Configures sudo
• sudo::install: Installs sudo

Classes

sudo

Installs and configures sudo

Examples

include sudo

Parameters

The following parameters are available in the sudo class:

• install_package
• package_name
• package_ensure
• package_provider
• sudoers
• manage_sudoers
• includedir
• purge_includedir
• includedir_mode
• defaultmode
• owner
• group
• use_includedir
• conf

install_package

Data type: Boolean

Determines if package for sudo should be installed.

Default value: true

package_name

Data type: String[1]

The name of the package to install.

Default value: 'sudo'

package_ensure

Data type: String[1]

What value for 'ensure' to pass to resource type package.

Default value: 'present'

package_provider

Data type: Optional[String]

Override the default package provider.

Default value: undef

sudoers

Data type: Stdlib::Unixpath

The main configuration file for the sudoers plugin.

Default value: '/etc/sudoers'

manage_sudoers

Data type: Boolean

Don't manage the primary sudoers file is this is false.

Default value: true

includedir

Data type: Stdlib::Unixpath

The dropin directory for additional config files.

Default value: '/etc/sudoers.d'

purge_includedir

Data type: Boolean

Purge any files in $includedir not explicitly managed by this class.

Default value: false

includedir_mode

Data type: Stdlib::Filemode

The filemode for the includedir

Default value: '750'

defaultmode

Data type: Stdlib::Filemode

The mode for creates files in includedir.

Default value: '440'

owner

Data type: String[1]

The owner for sudo configfiles.

Default value: 'root'

group

Data type: String[1]

The group for sudo configfiles.

Default value: 'root'

use_includedir

Data type: Boolean

Add entry for includedir to main sudoer file if true.

Default value: true

conf

Data type: Hash[String,Hash[String,Optional[Any]]]

Default value: undef

0.1.1

Mar 13 2022

• Add parameters purge_includedir, manage_sudoers
• Add default sudoers config for RedHat FreeBSD and Gentoo