\begin{exe} {Configuring the System for \textbf{sudo} }

   It is very dangerous to run a \textbf{root shell}
   unless absolutely necessary: a single typo or other
   mistake can cause serious (even fatal) damage.

   Thus, the sensible procedure is to configure things
   such that single commands may be run with superuser
   privilege, by using the \textbf{sudo} mechanism.  With
   \textbf{sudo} the user only needs to know their own
   password and never needs to know the root password.

   If you are using a distribution such as
   \textbf{Ubuntu}, you may not need to do this lab to
   get \textbf{sudo} configured properly for the
   course. However, you should still make sure you
   understand the procedure.

   To check if your system is already configured to let
   the user account you are using run \textbf{sudo}, just
   do a simple command like:
   \begin{raw}
$ sudo ls
   \end{raw}

   You should be prompted for your user password and then
   the command should execute.  If instead, you get an
   error message you need to execute the following procedure.

   Launch a root shell by typing \textbf{su} and then giving the
   \textbf{root} password, not your user password.

   On all recent \textbf{Linux} distributions you should
   navigate to the \filelink{/etc/sudoers.d} subdirectory
   and create a file, usually with the name of the user
   to whom root wishes to grant \textbf{sudo}
   access. However, this convention is not actually
   necessary as \textbf{sudo} will scan all files in this
   directory as needed.  The file can simply contain:
   \begin{rawbr}
student ALL=(ALL)  ALL
   \end{rawbr}

   if the user is \verb?student?.

   An older practice (which certainly still works) is to add
   such a line at the end of the file \filelink{/etc/sudoers}.
   It is best to do so using the \textbf{visudo} program,
   which is careful about making sure you use the right syntax
   in your edit.

   You probably also need to set proper permissions on the file
   by typing:

   \begin{raw}
$ sudo chmod 440 /etc/sudoers.d/student
   \end{raw}
   (Note some \textbf{Linux} distributions may require
   \verb?400? instead of \verb?440? for the permissions.)

   After you have done these steps, exit the root shell by
   typing \verb?exit? and then try to do \verb?sudo ls? again.

   There are many other ways an administrator can
   configure \textbf{sudo}, including specifying only certain
   permissions for certain users, limiting searched paths etc.
   The \filelink{/etc/sudoers} file is very well self-documented.

   However, there is one more setting we highly
   recommend you do, even if your system already has
   \textbf{sudo} configured.  Most distributions
   establish a different path for finding executables
   for normal users as compared to root users.  In
   particular the directories \filelink{/sbin} and
   \filelink{/usr/sbin} are not searched, since
   \textbf{sudo} inherits the \verb?PATH? of the user,
   not the full root user.

   Thus, in this course we would have to be constantly
   reminding you of the full path to many system
   administration utilities; any enhancement to security
   is probably not worth the extra typing and figuring
   out which directories these programs are in.
   Consequently, we suggest you add the following line to
   the \filelink{.bashrc} file in your home directory:
   \begin{rawbr}
PATH=$PATH:/usr/sbin:/sbin
   \end{rawbr}
   If you log out and then log in again (you don't have to reboot)
   this will be fully effective.
\end{exe}

