\n
ssh username@server_ip_address<\/p>\n<\/div><\/div>\n\n\n\n
If it’s your first time connecting to the server, you may see a security warning about the authenticity of the host. Verify that the displayed fingerprint matches the expected fingerprint, and then proceed by typing \u2018yes\u2019<\/strong> when prompted.<\/p>\n\n\n\n <\/figure>\n\n\n\nNext, you will be prompted to enter your password. Type in your password carefully, as you won’t see any characters being entered on the screen. Press \u2018Enter\u2019 <\/strong>after entering the password.<\/p>\n\n\n\nIf the provided username and password are correct, you will be logged in to the Rocky Linux server via SSH, and the command prompt will change to reflect your remote connection.<\/p>\n\n\n\n <\/figure>\n\n\n\nStep 2: Create a new user<\/h3>\n\n\n\n Run the following command in order to create a new user:<\/p>\n\n\n\n
\n
adduser jumpcloud<\/p>\n<\/div><\/div>\n\n\n\n
This command will create a home directory and assign a default shell and configuration files.<\/p>\n\n\n\n
Next, make sure that you create a complex password for your newly created user. Do this by running the following prompt:<\/p>\n\n\n\n
\n
passwd jumpcloud<\/p>\n<\/div><\/div>\n\n\n\n
After that, make sure your user exists and has its own group by run the id<\/em> command:<\/p>\n\n\n\n\n
id jumpcloud<\/p>\n<\/div><\/div>\n\n\n\n
There you will see a similar output:<\/p>\n\n\n\n <\/figure>\n\n\n\nStep 3: Assign sudo permissions to the user<\/h3>\n\n\n\n Now, you\u2019ll elevate the permissions of the jumpcloud<\/em> user so they can execute sudo commands.<\/p>\n\n\n\nType the following command:<\/p>\n\n\n\n
\n
sudo usermod -aG wheel jumpcloud<\/p>\n<\/div><\/div>\n\n\n\n
Let\u2019s break down the parts of this command.<\/p>\n\n\n\n
\nusermod<\/em><\/strong> is a command in Linux used to modify user account attributes. In this case, it\u2019s modifying the attributes of the user specified in the command.<\/li>\n<\/ul>\n\n\n\n\n-aG wheel<\/em><\/strong> <\/strong>are options for the usermod<\/em><\/strong> command.\n\n-a<\/strong> stands for “append.” It instructs the usermod command to append the specified user to the existing groups without removing them from any other groups.<\/li>\n\n\n\n-G wheel <\/strong>specifies the group to which the user should be added. In this case, it adds the “jumpcloud” user to the “wheel” group.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\nNow, if you again run the id command, you\u2019ll see that your user is in the \u2018wheel\u2019 <\/strong>group. In Linux systems, the \u2018wheel\u2019<\/strong> group is typically used to grant higher permissions to certain users who are allowed to run commands with elevated privileges using the \u2018sudo\u2019 <\/strong>command. <\/p>\n\n\n\n\n
id jumpcloud<\/p>\n<\/div><\/div>\n\n\n\n <\/figure>\n\n\n\nThis will now give you the ability to run commands as sudo.<\/p>\n\n\n\n
Step 4: Test the sudo access<\/h3>\n\n\n\n Now, test your sudo user. First, switch to your user by running the following command:<\/p>\n\n\n\n
\n
su – jumpcloud<\/p>\n<\/div><\/div>\n\n\n\n
If you try to execute a command that requires higher administrative access without sudo access, you will get the error that the operation is not permitted.<\/p>\n\n\n\n
\n
yum update<\/p>\n<\/div><\/div>\n\n\n\n <\/figure>\n\n\n\nNow, try running it with the sudo command:<\/p>\n\n\n\n
\n
sudo yum update<\/p>\n<\/div><\/div>\n\n\n\n
The terminal prompt will ask for the password. After entering it and pressing \u2018Enter\u2019,<\/strong> You\u2019ll be able to run the update process.<\/p>\n\n\n\n <\/figure>\n\n\n\nStep 5: Set up logging for all sudo commands<\/h3>\n\n\n\n Enabling command logging for sudo users is a good security measure, as it helps in auditing and accountability, allowing you to track user actions and identify potential security issues or misuse of privileges. To log all commands performed by a sudo user in Rocky Linux, you can enable sudo command logging. <\/p>\n\n\n\n
This can be done by editing the sudoers file. This file is the main configuration for the sudo command in Linux. It defines the rules and permissions for executing commands with elevated privileges using sudo. <\/p>\n\n\n\n
First, log in to your Rocky Linux system as a root or sudo user. Then, change to the \/var\/log <\/strong>directory, then create a directory under \/var\/log\/sudo<\/strong>:<\/p>\n\n\n\n\n
cd \/var\/log<\/p>\n<\/div><\/div>\n\n\n\n
\n
sudo mkdir sudo<\/p>\n<\/div><\/div>\n\n\n\n
Set the appropriate permissions on the log directory to ensure that sudo users can write to it:<\/p>\n\n\n\n
\n
sudo chmod 750 \/var\/log\/sudo<\/p>\n<\/div><\/div>\n\n\n\n
Make sure that the sudo directory belongs to the root user and group:<\/p>\n\n\n\n
\n
sudo chown root:root \/var\/log\/sudo<\/p>\n<\/div><\/div>\n\n\n\n
Next, open the sudoers file using a text editor. In Rocky Linux, it is recommended to use the visudo<\/strong> command, which provides syntax checking and prevents potential errors.<\/p>\n\n\n\n\n
sudo visudo<\/p>\n<\/div><\/div>\n\n\n\n
Locate the line that starts with Defaults env_reset<\/strong>. This line specifies the default settings for sudo.<\/p>\n\n\n\n <\/figure>\n\n\n\nPress “i<\/strong>” to enter edit mode in Vi editor.<\/p>\n\n\n\nAdd the following line below Defaults env_reset<\/strong> to enable command logging:<\/p>\n\n\n\n\n
Defaults logfile=”\/var\/log\/sudo\/sudo.log”<\/p>\n<\/div><\/div>\n\n\n\n
Press \u2018Esc\u2019 <\/strong>and type wq<\/em><\/strong> so we can write the changes and exit the file. Then, press \u2018Enter\u2019<\/strong> to exit.<\/p>\n\n\n\n <\/figure>\n\n\n\nFrom now on, all commands executed by sudo users will be logged to the specified file. You can examine the logs by checking the contents of the \/var\/log\/sudo\/sudo.log <\/strong>file using a text editor or the cat command.<\/p>\n\n\n\nNow with our jumpcloud<\/em> user, let’s run a couple of commands that require sudo access:<\/p>\n\n\n\n\n
sudo yum update sudo iotop<\/p>\n<\/div><\/div>\n\n\n\n
Press \u2018Ctrl + C\u2019<\/strong> to exit the iotop <\/em>process<\/p>\n\n\n\nYou can now check the log file, to see the commands executed by that sudo user:<\/p>\n\n\n\n
\n
sudo cat \/var\/log\/sudo\/sudo.log<\/p>\n<\/div><\/div>\n\n\n\n
You can see the output and the recorded commands for the sudo users.<\/p>\n\n\n\n <\/figure>\n\n\n\nIn the output, you\u2019ll see information about the user that performed the action and the exact timestamp of the action, which is very valuable for audit logs.<\/p>\n\n\n\n
Improve Rocky Linux Security with JumpCloud<\/h2>\n\n\n\n In this article, we\u2019ve shown you how to create sudo users in Rocky Linux, to grant privileged access to specific users as necessary without putting your root system at risk. But while sudo users are important for good security, they aren\u2019t the only feature that can improve the safety of your Rocky Linux system. Other measures, like enabling Full Disk Encryption (FDE) further increase security. Learn more about the benefits of FDE here.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Learn how to create sudo users, accounts configured with least privilege admin rights that balance access and security, for Rocky Linux. <\/p>\n","protected":false},"author":150,"featured_media":94295,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2781],"tags":[],"collection":[2777],"platform":[],"funnel_stage":[3016],"coauthors":[2535],"acf":[],"yoast_head":"\n
How to Create Sudo Users for Rocky Linux - JumpCloud<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n\t \n\t \n\t \n