roles/common/: Do the rest of the common configuration.

[distorted-ansible] / roles / common / files / sudo / sudoers

diff --git a/roles/common/files/sudo/sudoers b/roles/common/files/sudo/sudoers
new file mode 100644 (file)
index 0000000..7676429
--- /dev/null
+++ b/roles/common/files/sudo/sudoers
@@ -0,0 +1,62 @@
+### -*-conf-*-
+### sudoers file for distorted.org.uk
+###
+### This file is maintained on ibanez: edit it there and run `update-slaves'.
+
+###--------------------------------------------------------------------------
+### Thoughts.
+###
+### I'm not using `sudo' to give people limited access to privileged
+### commands.  That's a mug's game, and anyway `userv' does it better.
+### So I'm not going to try to restrict what administrators can do.
+
+###--------------------------------------------------------------------------
+### Defaults.
+
+## The `authentication' -- making people type in their passwords -- will
+## only thwart an unimaginitive attacker.  We have to face up to the fact
+## that `sudo' basically deals in `at-least-as-powerful-as' relationships:
+## if Alice can `sudo' to Bob, then Alice is at least as powerful as Bob,
+## and all of the molly guards and password typing won't help that.
+Defaults !authenticate
+
+## Again, with the idea that we're trusting the calling users, we don't
+## to scrub the environment.
+Defaults !always_set_home, !env_reset, !secure_path
+       
+## Allow any editor with `visudo'.  The idea that allowing a user to edit
+## the `sudoers' file is OK but letting him choose which editor he uses
+## isn't is obviously crazy.  After all, he can change the editor list
+## if he likes.
+Defaults env_editor
+
+## Don't spam me with reports of people being turned away.  I have logs for
+## that.
+Defaults !mailto
+
+## I'm going to assume that administrators already know how to behave
+## responsibly.
+Defaults lecture = never
+
+## Passing file descriptors into a program seems OK to me, given that
+## I'm assuming that the target user trusts the caller anyway.
+Defaults !closefrom_override
+
+###--------------------------------------------------------------------------
+### Administration.
+###
+### Summary:
+###    FROM    HOSTS = (TO-USERS [: TO-GROUPS]) [TAGS] COMMAND
+###
+### LIST ::= [!] ITEM, ...
+### USER ::= NAME | #UID | %GROUP
+### HOST ::= HOSTNAME | ADDR | NET/MASK
+### COMMAND ::= CMD | DIR/ | sudoedit
+### TAG ::= NOPASSWD: | PASSWD: | NOEXEC: | EXEC: | SETENV: | NOSETENV: |
+###    LOG_INPUT: | NOLOG_INPUT: | LOG_OUTPUT: | NOLOG_OUTPUT:
+
+## Allow `root' and members of the `sudo' and `root' groups to do their
+## things.
+root, %sudo, %root, %wheel     ALL = (ALL : ALL) ALL
+
+###----- That's all, folks --------------------------------------------------