version 1.1.1.3, 2012/10/09 09:29:52
|
version 1.1.1.4, 2013/07/22 10:46:10
|
Line 7 more options than it did before. Please read this doc
|
Line 7 more options than it did before. Please read this doc
|
before configuring and building sudo. You may also wish to read the |
before configuring and building sudo. You may also wish to read the |
file INSTALL.configure which explains more about the `configure' script. |
file INSTALL.configure which explains more about the `configure' script. |
|
|
|
System requirements |
|
=================== |
|
|
|
To build sudo from the source distribution you need a POSIX-compliant |
|
operating system (any modern version of BSD, Linux or Unix should work), |
|
an ANSI/ISO C compiler that supports the "long long" type, variadic |
|
macros (a C99 feature) as well as the ar, make and ranlib utilities. |
|
|
|
If you wish to modify the parser then you will need flex version |
|
2.5.2 or later and either bison or byacc (sudo comes with a |
|
pre-generated parser). You'll also have to run configure with the |
|
--with-devel option or pass DEVEL=1 to make. You can get flex from |
|
http://flex.sourceforge.net/. You can get GNU bison from |
|
ftp://ftp.gnu.org/pub/gnu/bison/ or any GNU mirror. |
|
|
Simple sudo installation |
Simple sudo installation |
======================== |
======================== |
|
|
Line 19 For most systems and configurations it is possible sim
|
Line 34 For most systems and configurations it is possible sim
|
"gotchas" relating to your operating system. |
"gotchas" relating to your operating system. |
|
|
2) `cd' to the source or build directory and type `./configure' |
2) `cd' to the source or build directory and type `./configure' |
to generate a Makefile and config.h file suitable for | to generate a Makefile and config.h file suitable for building |
building sudo. Before you actually run configure you | sudo. Before you actually run configure you should read the |
should read the `Available configure options' section | `Available configure options' section to see if there are |
to see if there are any special options you may want | any special options you may want or need. |
or need. | |
|
|
3) Edit the configure-generated Makefile if you wish to | 4) Type `make' to compile sudo. If you are building sudo |
change any of the default paths (alternatively, you could | |
have changed the paths via options to `configure'. | |
| |
5) Type `make' to compile sudo. If you are building sudo | |
in a separate build tree (apart from the sudo source) GNU |
in a separate build tree (apart from the sudo source) GNU |
make will probably be required. If `configure' did its job |
make will probably be required. If `configure' did its job |
properly (and you have a supported configuration) there won't |
properly (and you have a supported configuration) there won't |
be any problems. If this doesn't work, take a look at the |
be any problems. If this doesn't work, take a look at the |
TROUBLESHOOTING file for tips on what might have gone wrong. | doc/TROUBLESHOOTING file for tips on what might have gone |
Please mail us if you have a fix or if you are unable to | wrong. Please mail us if you have a fix or if you are unable |
come up with a fix (address at EOF). | to come up with a fix (address at EOF). |
|
|
6) Type `make install' (as root) to install sudo, visudo, the | 5) Type `make install' (as root) to install sudo, visudo, the |
man pages, and a skeleton sudoers file. Note that the install |
man pages, and a skeleton sudoers file. Note that the install |
will not overwrite an existing sudoers file. You can also |
will not overwrite an existing sudoers file. You can also |
install various pieces the package via the install-binaries, |
install various pieces the package via the install-binaries, |
install-doc, and install-sudoers make targets. |
install-doc, and install-sudoers make targets. |
|
|
7) Edit the sudoers file with `visudo' as necessary for your | 6) Edit the sudoers file with `visudo' as necessary for your |
site. You will probably want to refer the sample.sudoers |
site. You will probably want to refer the sample.sudoers |
file and sudoers man page included with the sudo package. |
file and sudoers man page included with the sudo package. |
|
|
8) If you want to use syslogd(8) to do the logging, you'll need | 7) If you want to use syslogd(8) to do the logging, you'll need |
to update your /etc/syslog.conf file. See the sample.syslog.conf |
to update your /etc/syslog.conf file. See the sample.syslog.conf |
file included in the distribution for an example. |
file included in the distribution for an example. |
|
|
Line 74 Configuration:
|
Line 84 Configuration:
|
--quiet, --silent, -q |
--quiet, --silent, -q |
Do not print `checking...' messages |
Do not print `checking...' messages |
|
|
|
--srcdir=DIR |
|
Find the sources in DIR [configure dir or `..'] |
|
|
Directory and file names: |
Directory and file names: |
--prefix=PREFIX |
--prefix=PREFIX |
Install architecture-independent files in PREFIX This really only | Install architecture-independent files in PREFIX. [/usr/local] |
applies to man pages. [/usr/local] | |
|
|
--exec-prefix=EPREFIX |
--exec-prefix=EPREFIX |
Install architecture-dependent files in EPREFIX This includes the | Install architecture-dependent files in EPREFIX. |
sudo and visudo executables. [same as prefix] | This includes the executables and plugins. [same as PREFIX] |
|
|
--bindir=DIR |
--bindir=DIR |
Install `sudo' in DIR [EPREFIX/bin] | Install `sudo', `sudoedit' and `sudoreplay' in DIR. [EPREFIX/bin] |
|
|
--sbindir=DIR |
--sbindir=DIR |
Install `visudo' in DIR [EPREFIX/sbin] | Install `visudo' in DIR. [EPREFIX/sbin] |
|
|
|
--libexecdir=DIR |
|
Install plugins and helper programs in DIR/sudo [PREFIX/libexec/sudo] |
|
|
--sysconfdir=DIR |
--sysconfdir=DIR |
Install `sudoers' file in DIR [/etc] | Look for `sudo.conf' and `sudoers' files in DIR. [/etc] |
|
|
|
--includedir=DIR |
|
Install sudo_plugin.h include file in DIR [PREFIX/include] |
|
|
|
--datarootdir=DIR |
|
Root directory for platform-independent data files [PREFIX/share] |
|
|
|
--localedir=DIR |
|
Install sudo and sudoers locale files in DIR [DATAROOTDIR/locale] |
|
|
--mandir=DIR |
--mandir=DIR |
Install man pages in DIR [PREFIX/man] |
Install man pages in DIR [PREFIX/man] |
|
|
--srcdir=DIR | --docdir=DIR |
Find the sources in DIR [configure dir or ..] | Install other sudo documentation in DIR [DATAROOTDIR/doc/sudo] |
|
|
Special features/options: | --with-plugindir=PATH |
| Set the directory that sudo looks in to find the policy and I/O |
| logging plugins. Defaults to the LIBEXEC/sudo. |
| |
| --with-timedir=PATH |
| Use PATH to store the sudo time stamp files. By default, |
| the first existing directory in the following list is used: |
| /var/db, /var/lib, /var/adm, /usr/adm. |
| |
| Compilation options: |
| --disable-hardening |
| Disable the use of compiler/linker exploit mitigation options |
| which are enabled by default. This includes compiling with |
| _FORTIFY_SOURCE defined to 2, building with -fstack-protector |
| and linking with -zrelro, where supported. |
| |
| --enable-pie |
| Build sudo and related programs as as a position independent |
| executables (PIE). This improves the effectiveness of address |
| space layout randomization (ASLR) on systems that support it. |
| Sudo will create PIE binaries by default on Linux systems. |
| |
| --disable-pie |
| Disable the creation of position independent executables (PIE), |
| even if the compiler creates PIE binaries by default. This |
| option may be needed on some Linux systems where PIE binaries |
| are not fully supported. |
| |
| --disable-rpath |
| By default, configure will use -Rpath in addition to -Lpath |
| when passing library paths to the loader. This option will |
| disable the use of -Rpath. |
| |
| --disable-shared |
| Disable dynamic shared object support. By default, sudo |
| is built with a plugin API capable of loading arbitrary |
| policy and I/O logging plugins. If the --disable-shared |
| option is specified, this support is disabled and the default |
| sudoers policy and I/O plugins are embedded in the sudo |
| binary itself. This will also disable the noexec option |
| as it too relies on dynamic shared object support. |
| |
| --enable-zlib[=location] |
| Enable the use of the zlib compress library when storing |
| I/O log files. If specified, location is the base directory |
| containing the zlib include and lib directories. The special |
| values "system" and "builtin" can be used to indicate that |
| the system version of zlib should be used or that the version |
| of zlib shipped with sudo should be used instead. |
| If this option is not specified, configure will use the |
| system zlib if it is present. |
| |
--with-incpath=DIR |
--with-incpath=DIR |
Adds the specified directory (or directories) to CPPFLAGS |
Adds the specified directory (or directories) to CPPFLAGS |
so configure and the compiler will look there for include |
so configure and the compiler will look there for include |
files. Multiple directories may be specified as long as |
files. Multiple directories may be specified as long as |
they are space separated. |
they are space separated. |
Eg: --with-incpath="/usr/local/include /opt/include" | E.g. --with-incpath="/usr/local/include /opt/include" |
|
|
--with-libpath=DIR |
--with-libpath=DIR |
Adds the specified directory (or directories) to LDFLAGS |
Adds the specified directory (or directories) to LDFLAGS |
so configure and the compiler will look there for libraries. |
so configure and the compiler will look there for libraries. |
Multiple directories may be specified as with --with-incpath. |
Multiple directories may be specified as with --with-incpath. |
|
|
--with-rpath |
|
Tells configure to use -Rpath in addition to -Lpath when |
|
passing library paths to the loader. This option is on |
|
by default for Solaris and SVR4. |
|
|
|
--with-blibpath[=PATH] |
|
Tells configure to construct a -blibpath argument to the |
|
loader. If a PATH is specified, it will be used as the |
|
base. Otherwise, "/usr/lib:/lib:/usr/local/lib" will be |
|
used for gcc and "/usr/lib:/lib" for non-gcc. Additional |
|
library paths will be appended as needed by configure. |
|
This option is only valid for AIX where it is on by default. |
|
|
|
--with-libraries=LIBRARY |
--with-libraries=LIBRARY |
Adds the specified library (or libaries) to SUDO_LIBS and | Adds the specified library (or libraries) to SUDO_LIBS and |
and VISUDO_LIBS so sudo will link against them. If the |
and VISUDO_LIBS so sudo will link against them. If the |
library doesn't start with `-l' or end in `.a' or `.o' a |
library doesn't start with `-l' or end in `.a' or `.o' a |
`-l' will be prepended to it. Multiple libraries may be | `-l' will be pre-pended to it. Multiple libraries may be |
specified as long as they are space separated. |
specified as long as they are space separated. |
|
|
--with-plugindir=PATH | --with-libtool=PATH |
Set the directory that sudo looks in to find the policy and I/O | By default, sudo will use the included version of libtool |
logging plugins. Defaults to the libexec dir used by configure. | to build shared libraries. The --with-libtool option can |
| be used to specify a different version of libtool to use. |
| The special values "system" and "builtin" can be used in |
| place of a path to denote the default system libtool (obtained |
| via the user's PATH) and the default libtool that comes |
| with sudo. |
|
|
--with-efence | Optional features: |
Link with the "electric fence" debugging malloc. | --disable-root-mailer |
| By default sudo will run the mailer as root when tattling |
| on a user so as to prevent that user from killing the mailer. |
| With this option, sudo will run the mailer as the invoking |
| user which some people consider to be safer. |
|
|
--with-bsm-audit | --enable-nls[=location] |
Enable support for sudo BSM audit logs on systems that support | Enable natural language support using the gettext() family |
it. Currently only supported under FreeBSD and Mac OS X. | of functions. If specified, location is the base directory |
| containing the libintl include and lib directories. If |
| this option is not specified, configure will look for the |
| gettext() family of functions in the standard C library |
| first, then check for a standalone libintl (linking with |
| libiconv as needed). |
|
|
--with-csops | --disable-nls |
Add CSOps standard options. You probably aren't interested in this. | Disable natural language support. By default, sudo will |
| use the gettext() family of functions, if available, to |
| implement messages in the invoking user's native language. |
| Note that translations do not exist for all languages. |
|
|
--with-devel |
|
Configure development options. This will enable compiler warnings |
|
and set the Makefile to be able to regenerate the sudoers parser |
|
as well as the manual pages. |
|
|
|
--with-linux-audit |
|
Enable audit support for Linux systems. Audits attempts |
|
to run a command as well as SELinux role changes. |
|
|
|
--with-skey[=DIR] |
|
Enable S/Key OTP (One Time Password) support. If specified, |
|
DIR should contain include and lib directories with skey.h |
|
and libskey.a respectively. |
|
|
|
--with-opie[=DIR] |
|
Enable NRL OPIE OTP (One Time Password) support. If specified, |
|
DIR should contain include and lib directories with opie.h |
|
and libopie.a respectively. |
|
|
|
--with-SecurID[=DIR] |
|
Enable SecurID support. If specified, DIR is directory containing |
|
libaceclnt.a, acexport.h, and sdacmvls.h. |
|
|
|
--with-fwtk[=DIR] |
|
Enable TIS Firewall Toolkit (FWTK) 'authsrv' support. If specified, |
|
DIR is the base directory containing the compiled FWTK package |
|
(or at least the library and header files). |
|
|
|
--with-kerb5[=DIR] |
|
Enable Kerberos V support. If specified, DIR is the base |
|
directory containing the Kerberos V include and lib dirs. |
|
This This uses Kerberos passphrases for authentication but |
|
does not use the Kerberos cookie scheme. Will not work for |
|
Kerberos V older than version 1.1. |
|
|
|
--enable-kerb5-instance=string |
|
By default, the user name is used as the principal name |
|
when authenticating via Kerberos V. If this option is |
|
enabled, the specified instance string will be appended to |
|
the user name (separated by a slash) when creating the |
|
principal name. |
|
|
|
--with-ldap[=DIR] |
--with-ldap[=DIR] |
Enable LDAP support. If specified, DIR is the base directory |
Enable LDAP support. If specified, DIR is the base directory |
containing the LDAP include and lib directories. Please see |
containing the LDAP include and lib directories. Please see |
Line 201 Special features/options:
|
Line 238 Special features/options:
|
this file instead of /etc/ldap.secret to read the secret password |
this file instead of /etc/ldap.secret to read the secret password |
when rootbinddn is specified in the ldap config file. |
when rootbinddn is specified in the ldap config file. |
|
|
|
--with-logincap |
|
This adds support for login classes specified in /etc/login.conf. |
|
It is enabled by default on BSD/OS, Darwin, FreeBSD, OpenBSD and |
|
NetBSD (where available). By default, a login class is not applied |
|
unless the 'use_loginclass' option is defined in sudoers or the user |
|
specifies a class on the command line. |
|
|
|
--with-interfaces=no, --without-interfaces |
|
This option keeps sudo from trying to glean the ip address |
|
from each attached Ethernet interface. It is only useful |
|
on a machine where sudo's interface reading support does |
|
not work, which may be the case on some SysV-based OS's |
|
using STREAMS. |
|
|
|
--with-noexec[=PATH] |
|
Enable support for the "noexec" functionality which prevents |
|
a dynamically-linked program being run by sudo from executing |
|
another program (think shell escapes). Please see the |
|
"PREVENTING SHELL ESCAPES" section in the sudoers man page |
|
for details. If specified, PATH should be a fully qualified |
|
path name, e.g. /usr/local/libexec/sudo_noexec.so. If PATH |
|
is "no", noexec support will not be compiled in. The default |
|
is to compile noexec support if libtool supports building |
|
shared objects on your OS. |
|
|
|
--with-selinux |
|
Enable support for role based access control (RBAC) on |
|
systems that support SELinux. |
|
|
--with-sssd |
--with-sssd |
Enable support for using the System Security Services Daemon |
Enable support for using the System Security Services Daemon |
(SSSD) as a sudoers data source. For more informaton on | (SSSD) as a sudoers data source. For more information on |
SSD, see http://fedorahosted.org/sssd/ |
SSD, see http://fedorahosted.org/sssd/ |
|
|
--with-sssd-lib=PATH |
--with-sssd-lib=PATH |
Specify the path to the SSSD shared library, which is loaded |
Specify the path to the SSSD shared library, which is loaded |
at run-time. |
at run-time. |
|
|
--with-nsswitch[=PATH] | Operating system-specific options: |
Path to nsswitch.conf or "no" to disable nsswitch support. | --disable-setreuid |
If specified, sudo uses this file instead of /etc/nsswitch.conf. | Disable use of the setreuid() function for operating systems |
If nsswitch is disabled but LDAP is enabled, sudo will check | where it is broken. For instance, 4.4BSD has setreuid() |
LDAP first, then the sudoers file. | that is not fully functional. |
|
|
|
--disable-setresuid |
|
Disable use of the setresuid() function for operating systems |
|
where it is broken (none currently known). |
|
|
|
--enable-admin-flag |
|
Enable the creation of an Ubuntu-style admin flag file |
|
the first time sudo is run. |
|
|
|
--with-bsm-audit |
|
Enable support for sudo BSM audit logs on systems that support it. |
|
This includes recent versions of FreeBSD, Mac OS X and Solaris. |
|
|
|
--with-linux-audit |
|
Enable audit support for Linux systems. Audits attempts |
|
to run a command as well as SELinux role changes. |
|
|
|
--with-man |
|
Use the "man" macros for manual pages. By default, mdoc versions |
|
of the manuals are installed if supported. This can be used to |
|
override configure's test for "nroff -mdoc" support. |
|
|
|
--with-mdoc |
|
Use the "mdoc" macros for manual pages. By default, mdoc versions |
|
of the manuals are installed if supported. This can be used to |
|
override configure's test for "nroff -mdoc" support. |
|
|
--with-netsvc[=PATH] |
--with-netsvc[=PATH] |
Path to netsvc.conf or "no" to disable netsvc.conf support. |
Path to netsvc.conf or "no" to disable netsvc.conf support. |
If specified, sudo uses this file instead of /etc/netsvc.conf |
If specified, sudo uses this file instead of /etc/netsvc.conf |
on AIX systems. | on AIX systems. If netsvc support is disabled but LDAP is |
| enabled, sudo will check LDAP first, then the sudoers file. |
|
|
|
--with-nsswitch[=PATH] |
|
Path to nsswitch.conf or "no" to disable nsswitch support. |
|
If specified, sudo uses this file instead of /etc/nsswitch.conf. |
|
If nsswitch support is disabled but LDAP is enabled, sudo will |
|
check LDAP first, then the sudoers file. |
|
|
|
--with-project |
|
Enable support for Solaris project resource limits. |
|
This option is only available on Solaris 9 and above. |
|
|
|
Authentication options: |
|
--with-AFS |
|
Enable AFS support with Kerberos authentication. Should work under |
|
AFS 3.3. If your AFS doesn't have -laudit you should be able to |
|
link without it. |
|
|
--with-aixauth |
--with-aixauth |
Enable support for the AIX 4.x general authentication function. |
Enable support for the AIX 4.x general authentication function. |
This will use the authentication scheme specified for the user |
This will use the authentication scheme specified for the user |
on the machine. It is on by default for AIX systems that |
on the machine. It is on by default for AIX systems that |
support it. |
support it. |
|
|
|
--with-bsdauth |
|
Enable support for BSD authentication. This is the default |
|
for BSD/OS and OpenBSD systems that support it. |
|
It is not possible to mix BSD authentication with other |
|
authentication methods (and there really should be no need |
|
to do so). Note that only the newer BSD authentication API |
|
is supported. If you don't have /usr/include/bsd_auth.h |
|
then you cannot use this. |
|
|
|
--with-DCE |
|
Enable DCE support for systems without PAM. Known to work on |
|
HP-UX 9.X, 10.X, and 11.0; other systems may require source |
|
code and/or `configure' changes. On systems with PAM support |
|
(such as HP-UX 11.0 and higher, Solaris, FreeBSD and Linux), the |
|
DCE PAM module (usually libpam_dce) should be used instead. |
|
|
|
--with-fwtk[=DIR] |
|
Enable TIS Firewall Toolkit (FWTK) 'authsrv' support. If specified, |
|
DIR is the base directory containing the compiled FWTK package |
|
(or at least the library and header files). |
|
|
|
--with-kerb5[=DIR] |
|
Enable Kerberos V support. If specified, DIR is the base |
|
directory containing the Kerberos V include and lib dirs. |
|
This uses Kerberos pass phrases for authentication but |
|
does not use the Kerberos cookie scheme. Will not work for |
|
Kerberos V older than version 1.1. |
|
|
|
--enable-kerb5-instance=string |
|
By default, the user name is used as the principal name |
|
when authenticating via Kerberos V. If this option is |
|
enabled, the specified instance string will be appended to |
|
the user name (separated by a slash) when creating the |
|
principal name. |
|
|
|
--with-opie[=DIR] |
|
Enable NRL OPIE OTP (One Time Password) support. If specified, |
|
DIR should contain include and lib directories with opie.h |
|
and libopie.a respectively. |
|
|
|
--with-otp-only |
|
This option is now just an alias for --without-passwd. |
|
|
--with-pam |
--with-pam |
Enable PAM support. This is on by default for Darwin, FreeBSD, |
Enable PAM support. This is on by default for Darwin, FreeBSD, |
Linux, Solaris and HP-UX (version 11 and higher). |
Linux, Solaris and HP-UX (version 11 and higher). |
Line 247 Special features/options:
|
Line 399 Special features/options:
|
option from "sudo" to "sudo-i", allowing for a separate pam |
option from "sudo" to "sudo-i", allowing for a separate pam |
configuration for sudo's initial login mode. |
configuration for sudo's initial login mode. |
|
|
--with-AFS |
|
Enable AFS support with Kerberos authentication. Should work under |
|
AFS 3.3. If your AFS doesn't have -laudit you should be able to |
|
link without it. |
|
|
|
--with-DCE |
|
Enable DCE support for systems without PAM. Known to work on |
|
HP-UX 9.X, 10.X, and 11.0; other systems may require source |
|
code and/or `configure' changes. On systems with PAM support |
|
(such as HP-UX 11.0 and higher, Solaris, FreeBSD and Linux), the |
|
DCE PAM module (usually libpam_dce) should be used instead. |
|
|
|
--with-logincap |
|
This adds support for login classes specified in /etc/login.conf. |
|
It is enabled by default on BSD/OS, Darwin, FreeBSD, OpenBSD and |
|
NetBSD (where available). By default, a login class is not applied |
|
unless the 'use_loginclass' option is defined in sudoers or the user |
|
specifies a class on the command line. |
|
|
|
--with-bsdauth |
|
Enable support for BSD authentication. This is the default |
|
for BSD/OS and OpenBSD systems that support it. |
|
It is not possible to mix BSD authentication with other |
|
authentication methods (and there really should be no need |
|
to do so). Note that only the newer BSD authentication API |
|
is supported. If you don't have /usr/include/bsd_auth.h |
|
then you cannot use this. |
|
|
|
--with-project |
|
Enable support for Solaris project resource limits. |
|
This option is only available on Solaris 9 and above. |
|
|
|
--with-noexec[=PATH] |
|
Enable support for the "noexec" functionality which prevents |
|
a dynamically-linked program being run by sudo from executing |
|
another program (think shell escapes). Please see the |
|
"PREVENTING SHELL ESCAPES" section in the sudoers man page |
|
for details. If specified, PATH should be a fully qualified |
|
path name, e.g. /usr/local/libexec/sudo_noexec.so. If PATH |
|
is "no", noexec support will not be compiled in. The default |
|
is to compile noexec support if libtool supports building |
|
shared objects on your OS. |
|
|
|
--disable-pam-session |
--disable-pam-session |
Disable sudo's PAM session support. This may be needed on |
Disable sudo's PAM session support. This may be needed on |
older PAM implementations or on operating systems where |
older PAM implementations or on operating systems where |
Line 297 Special features/options:
|
Line 406 Special features/options:
|
PAM session support is disabled, resource limits may not |
PAM session support is disabled, resource limits may not |
be updated for the command being run. |
be updated for the command being run. |
|
|
--disable-root-mailer | --with-passwd=no, --without-passwd |
By default sudo will run the mailer as root when tattling | This option excludes authentication via the passwd (or |
on a user so as to prevent that user from killing the mailer. | shadow) file. It should only be used when another, alternative, |
With this option, sudo will run the mailer as the invoking | authentication scheme is in use. |
user which some people consider to be safer. | |
|
|
--disable-setreuid | --with-SecurID[=DIR] |
Disable use of the setreuid() function for operating systems | Enable SecurID support. If specified, DIR is directory containing |
where it is broken. Mac OS X has setreuid() but it doesn't | libaceclnt.a, acexport.h, and sdacmvls.h. |
really work. | |
|
|
--disable-setresuid | --with-skey[=DIR] |
Disable use of the setresuid() function for operating systems | Enable S/Key OTP (One Time Password) support. If specified, |
where it is broken (none currently known). | DIR should contain include and lib directories with skey.h |
| and libskey.a respectively. |
|
|
--disable-sia |
--disable-sia |
Disable SIA support. This is the "Security Integration |
Disable SIA support. This is the "Security Integration |
Line 322 Special features/options:
|
Line 430 Special features/options:
|
in shadow password support and use a shadow password if it |
in shadow password support and use a shadow password if it |
exists. |
exists. |
|
|
--with-sudoers-mode=MODE | --enable-gss-krb5-ccache-name |
File mode for the sudoers file (octal). Note that if you | Use the gss_krb5_ccache_name() function to set the Kerberos |
wish to NFS-mount the sudoers file this must be group | V credential cache file name. By default, sudo will use |
readable. Also note that this is actually set in the | the KRB5CCNAME environment variable to set this. While |
Makefile. The default mode is 0440. | gss_krb5_ccache_name() provides a better API to do this it |
| is not supported by all Kerberos V and SASL combinations. |
|
|
--with-sudoers-uid=UID | Development options: |
User id that "owns" the sudoers file. Note that this is | --enable-env-debug |
the numeric id, *not* the symbolic name. Also note that | Enable debugging of the environment setting functions. This |
this is actually set in the Makefile. The default is 0. | enables extra checks to make sure the environment does not |
| become corrupted. |
|
|
--with-sudoers-gid=GID | --enable-warnings |
Group id that "owns" the sudoers file. Note that this is | Enable compiler warnings when building sudo with gcc. |
the numeric id, *not* the symbolic name. Also note that | |
this is actually set in the Makefile. The default is 0. | |
|
|
--without-interfaces | --enable-werror |
This option keeps sudo from trying to glean the ip address | Enable the -Werror compiler option when building sudo with gcc. |
from each attached ethernet interface. It is only useful | |
on a machine where sudo's interface reading support does | |
not work, which may be the case on some SysV-based OS's | |
using STREAMS. | |
|
|
--without-passwd | --with-devel |
This option excludes authentication via the passwd (or | Configure development options. This will enable compiler warnings |
shadow) file. It should only be used when another, alternative, | and set up the Makefile to be able to regenerate the sudoers parser |
authentication scheme is in use. | as well as the manual pages. |
|
|
--with-otp-only | --with-efence |
This option is now just an alias for --without-passwd. | Link with the "electric fence" debugging malloc. |
|
|
--with-selinux | Options that set runtime-changeable default values: |
Enable support for role based access control (RBAC) on | --disable-authentication |
systems that support SELinux. | By default, sudo requires the user to authenticate via a |
| password or similar means. This options causes sudo to |
| *not* require authentication. It is possible to turn |
| authentication back on in sudoers via the PASSWD attribute. |
| Sudoers option: !authenticate |
|
|
--with-man | --disable-env-reset |
Use the "man" macros for manual pages. By default, mdoc | Disable environment resetting. This sets the default value |
versions of the manuals are installed. This can be used | of the "env_reset" Defaults option in sudoers to false. |
to override configure's test for "nroff -mdoc" support. | Sudoers option: !env_reset |
|
|
--with-mdoc | --disable-path-info |
Use the "mdoc" macros for manual pages. By default, mdoc | Normally, sudo will tell the user when a command could not be found |
versions of the manuals are installed. This can be used | in their $PATH. Some sites may wish to disable this as it could |
to override configure's test for "nroff -mdoc" support. | be used to gather information on the location of executables that |
| the normal user does not have access to. The disadvantage is that |
| if the executable is simply not in the user's path, sudo will tell |
| the user that they are not allowed to run it, which can be confusing. |
| Sudoers option: path_info |
|
|
The following options are also configurable at runtime: | --disable-root-sudo |
| Don't let root run sudo. This can be used to prevent people from |
| "chaining" sudo commands to get a root shell by doing something |
| like "sudo sudo /bin/sh". |
| Sudoers option: !root_sudo |
|
|
--with-long-otp-prompt | --disable-zlib |
When validating with a One Time Password scheme (S/Key or | Disable the use of the zlib compress library when storing |
OPIE), a two-line prompt is used to make it easier to cut | I/O log files. |
and paste the challenge to a local window. It's not as | Sudoers option: !compress_io |
pretty as the default but some people find it more convenient. | |
|
|
--with-logging=TYPE | --enable-log-host |
How you want to do your logging. You may choose "syslog", | Log the hostname in the log file. |
"file", or "both". Setting this to "syslog" is nice because | Sudoers option: log_host |
you can keep all of your sudo logs in one place (see the | |
sample.syslog.conf file). The default is "syslog". | |
|
|
--with-logfac=FACILITY | --enable-noargs-shell |
Determines which syslog facility to log to. This requires | If sudo is invoked with no arguments it acts as if the "-s" flag had |
a 4.3BSD or later version of syslog. You can still set | been given. That is, it runs a shell as root (the shell is determined |
this for ancient syslogs but it will have no effect. The | by the SHELL environment variable, falling back on the shell listed |
following facilities are supported: authpriv (if your OS | in the invoking user's /etc/passwd entry). |
supports it), auth, daemon, user, local0, local1, local2, | Sudoers option: shell_noargs |
local3, local4, local5, local6, and local7. | |
|
|
--with-goodpri=PRIORITY | --enable-shell-sets-home |
Determines which syslog priority to log successfully | If sudo is invoked with the "-s" flag the HOME environment variable |
authenticated commands. The following priorities are | will be set to the home directory of the target user (which is root |
supported: alert, crit, debug, emerg, err, info, notice, | unless the "-u" option is used). This option effectively makes the |
and warning. | "-s" flag imply "-H". |
| Sudoers option: set_home |
|
|
--with-badpri=PRIORITY | --with-all-insults |
Determines which syslog priority to log unauthenticated | Include all the insult sets listed below. You must either specify |
commands and errors. The following priorities are supported: | --with-insults or enable insults in the sudoers file for this to |
alert, crit, debug, emerg, err, info, notice, and warning. | have any effect. |
|
|
--with-logpath=PATH | --with-askpass=PATH |
Override the default location of the sudo log file and use | Set PATH as the "askpass" program to use when no tty is |
"path" instead. By default will use /var/log/sudo.log if | available. Typically, this is a graphical password prompter, |
there is a /var/log dir, falling back to /var/adm/sudo.log | similar to the one used by ssh. The program must take a |
or /usr/adm/sudo.log if not. | prompt as an argument and print the received password to |
| the standard output. This value may overridden at run-time |
| in the sudo.conf file. |
|
|
--with-loglen=NUMBER |
|
Number of characters per line for the file log. This is only used if |
|
you are to "file" or "both". This value is used to decide when to wrap |
|
lines for nicer log files. The default is 80. Setting this to 0 |
|
will disable the wrapping. |
|
|
|
--with-ignore-dot |
|
If set, sudo will ignore '.' or '' (current dir) in $PATH. |
|
The $PATH itself is not modified. |
|
|
|
--with-mailto=USER|MAIL_ALIAS |
|
User (or mail alias) that mail from sudo is sent to. |
|
This should go to a sysadmin at your site. The default is "root". |
|
|
|
--with-mailsubject="SUBJECT OF MAIL" |
|
Subject of the mail sent to the "mailto" user. The token "%h" |
|
will expand to the hostname of the machine. |
|
Default is "*** SECURITY information for %h ***". |
|
|
|
--without-mail-if-no-user |
|
Normally, sudo will mail to the "alertmail" user if the user invoking |
|
sudo is not in the sudoers file. This option disables that behavior. |
|
|
|
--with-mail-if-no-host |
|
Send mail to the "alermail" user if the user exists in the sudoers |
|
file, but is not allowed to run commands on the current host. |
|
|
|
--with-mail-if-noperms |
|
Send mail to the "alermail" user if the user is allowed to use sudo but |
|
the command they are trying is not listed in their sudoers file entry. |
|
|
|
--with-passprompt="PASSWORD PROMPT" |
|
Default prompt to use when asking for a password; can be overridden |
|
via the -p option and the SUDO_PROMPT environment variable. Supports |
|
the "%H", "%h", "%U" and "%u" escapes as documented in the sudo |
|
manual page. The default value is "Password:". |
|
|
|
--with-badpass-message="BAD PASSWORD MESSAGE" |
--with-badpass-message="BAD PASSWORD MESSAGE" |
Message that is displayed if a user enters an incorrect password. |
Message that is displayed if a user enters an incorrect password. |
The default is "Sorry, try again." unless insults are turned on. |
The default is "Sorry, try again." unless insults are turned on. |
|
Sudoers option: badpass_message |
|
|
--with-fqdn | --with-badpri=PRIORITY |
Define this if you want to put fully qualified hostnames in the sudoers | Determines which syslog priority to log unauthenticated |
file. Ie: instead of myhost you would use myhost.mydomain.edu. You may | commands and errors. The following priorities are supported: |
still use the short form if you wish (and even mix the two). Beware | alert, crit, debug, emerg, err, info, notice, and warning. |
that turning FQDN on requires sudo to make DNS lookups which may make | Sudoers option: syslog_badpri |
sudo unusable if your DNS is totally hosed. Also note that you must | |
use the host's official name as DNS knows it. That is, you may not use | |
a host alias (CNAME entry) due to performance issues and the fact that | |
there is no way to get all aliases from DNS. | |
|
|
--with-timedir=PATH |
|
Override the default location of the sudo timestamp directory and |
|
use "path" instead. |
|
|
|
--with-sendmail=PATH |
|
Override configure's guess as to the location of sendmail. |
|
|
|
--without-sendmail |
|
Do not use sendmail to mail messages to the "mailto" user. |
|
Use only if don't run sendmail or the equivalent. |
|
|
|
--with-umask=MASK |
|
Umask to use when running the root command. The default is 0022. |
|
|
|
--without-umask |
|
Preserves the umask of the user invoking sudo. |
|
|
|
--with-umask-override |
|
Use the umask specified in sudoers even if it is less restrictive |
|
than the user's. The default is to use the intersection of the |
|
user's umask and the umask specified in sudoers. |
|
|
|
--with-runas-default=USER |
|
The default user to run commands as if the -u flag is not specified |
|
on the command line. This defaults to "root". |
|
|
|
--with-exempt=GROUP |
|
Users in the specified group don't need to enter a password when |
|
running sudo. This may be useful for sites that don't want their |
|
"core" sysadmins to have to enter a password but where Jr. sysadmins |
|
need to. You should probably use NOPASSWD in sudoers instead. |
|
|
|
--with-passwd-tries=NUMBER |
|
Number of tries a user gets to enter his/her password before sudo logs |
|
the failure and exits. The default is 3. |
|
|
|
--with-timeout=NUMBER |
|
Number of minutes that can elapse before sudo will ask for a passwd |
|
again. The default is 5, set this to 0 to always prompt for a password. |
|
|
|
--with-password-timeout=NUMBER |
|
Number of minutes before the sudo password prompt times out. |
|
The default is 5, set this to 0 for no password timeout. |
|
|
|
--without-tty-tickets |
|
By default, sudo uses a different ticket file for each user/tty combo. |
|
With this option disabled, a single ticket will be used for all |
|
of a user's login sessions. |
|
|
|
--with-insults |
|
Define this if you want to be insulted for typing an incorrect password |
|
just like the original sudo(8). This is off by default. |
|
|
|
--with-insults=disabled |
|
Include support for insults but disable them unless explicitly |
|
enabled in sudoers. |
|
|
|
--with-all-insults |
|
Include all the insult sets listed below. You must either specify |
|
--with-insults or enable insults in the sudoers file for this to |
|
have any effect. |
|
|
|
--with-classic-insults |
--with-classic-insults |
Uses insults from sudo "classic." If you just specify --with-insults |
Uses insults from sudo "classic." If you just specify --with-insults |
you will get the classic and CSOps insults. This is on by default if |
you will get the classic and CSOps insults. This is on by default if |
Line 530 The following options are also configurable at runtime
|
Line 543 The following options are also configurable at runtime
|
--with-insults as well for this to have any effect. This is on by |
--with-insults as well for this to have any effect. This is on by |
default if --with-insults is given. |
default if --with-insults is given. |
|
|
--with-hal-insults |
|
Uses 2001-like insults when an incorrect password is entered. |
|
You must either specify --with-insults or enable insults in the |
|
sudoers file for this to have any effect. |
|
|
|
--with-goons-insults |
|
Insults the user with lines from the "Goon Show" when an incorrect |
|
password is entered. You must either specify --with-insults or |
|
enable insults in the sudoers file for this to have any effect. |
|
|
|
--with-pc-insults |
|
Replace politically incorrect insults with less objectionable ones. |
|
|
|
--with-secure-path[=PATH] |
|
Path used for every command run from sudo(8). If you don't trust the |
|
people running sudo to have a sane PATH environment variable you may |
|
want to use this. Another use is if you want to have the "root path" |
|
be separate from the "user path." You will need to customize the path |
|
for your site. NOTE: this is not applied to users in the group |
|
specified by --with-exemptgroup. If you do not specify a path, |
|
"/bin:/usr/ucb:/usr/bin:/usr/sbin:/sbin:/usr/etc:/etc" is used. |
|
|
|
--without-lecture |
|
Don't print the lecture the first time a user runs sudo. |
|
|
|
--with-editor=PATH |
--with-editor=PATH |
Specify the default editor path for use by visudo. This may be a |
Specify the default editor path for use by visudo. This may be a |
single path name or a colon-separated list of editors. In the latter |
single path name or a colon-separated list of editors. In the latter |
case, visudo will choose the editor that matches the user's VISUAL |
case, visudo will choose the editor that matches the user's VISUAL |
or EDITOR environment variables or the first editor in the list that |
or EDITOR environment variables or the first editor in the list that |
exists. The default is the path to vi on your system. |
exists. The default is the path to vi on your system. |
|
Sudoers option: editor |
|
|
--with-env-editor |
--with-env-editor |
Makes visudo consult the VISUAL and EDITOR environment variables before |
Makes visudo consult the VISUAL and EDITOR environment variables before |
Line 570 The following options are also configurable at runtime
|
Line 559 The following options are also configurable at runtime
|
is to use a colon-separated list of editors with the --with-editor |
is to use a colon-separated list of editors with the --with-editor |
option. visudo will then only use the VISUAL or EDITOR variables |
option. visudo will then only use the VISUAL or EDITOR variables |
if they match a value specified via --with-editor. |
if they match a value specified via --with-editor. |
|
Sudoers option: env_editor |
|
|
--with-askpass=PATH | --with-exempt=GROUP |
Set PATH as the "askpass" program to use when no tty is | Users in the specified group don't need to enter a password when |
available. Typically, this is a graphical password prompter, | running sudo. This may be useful for sites that don't want their |
similar to the one used by ssh. The program must take a | "core" sysadmins to have to enter a password but where Jr. sysadmins |
prompt as an argument and print the received password to | need to. You should probably use NOPASSWD in sudoers instead. |
the standard output. | Sudoers option: exempt_group |
|
|
|
--with-fqdn |
|
Define this if you want to put fully qualified host names in the sudoers |
|
file. Ie: instead of myhost you would use myhost.mydomain.edu. You may |
|
still use the short form if you wish (and even mix the two). Beware |
|
that turning FQDN on requires sudo to make DNS lookups which may make |
|
sudo unusable if your DNS is totally hosed. Also note that you must |
|
use the host's official name as DNS knows it. That is, you may not use |
|
a host alias (CNAME entry) due to performance issues and the fact that |
|
there is no way to get all aliases from DNS. |
|
Sudoers option: fqdn |
|
|
|
--with-goodpri=PRIORITY |
|
Determines which syslog priority to log successfully |
|
authenticated commands. The following priorities are |
|
supported: alert, crit, debug, emerg, err, info, notice, |
|
and warning. |
|
Sudoers option: syslog_goodpri |
|
|
|
--with-goons-insults |
|
Insults the user with lines from the "Goon Show" when an incorrect |
|
password is entered. You must either specify --with-insults or |
|
enable insults in the sudoers file for this to have any effect. |
|
|
|
--with-hal-insults |
|
Uses 2001-like insults when an incorrect password is entered. |
|
You must either specify --with-insults or enable insults in the |
|
sudoers file for this to have any effect. |
|
|
|
--with-ignore-dot |
|
If set, sudo will ignore '.' or '' (current dir) in $PATH. |
|
The $PATH itself is not modified. |
|
Sudoers option: ignore_dot |
|
|
|
--with-insults |
|
Define this if you want to be insulted for typing an incorrect password |
|
just like the original sudo(8). This is off by default. |
|
Sudoers option: insults |
|
|
|
--with-insults=disabled |
|
Include support for insults but disable them unless explicitly |
|
enabled in sudoers. |
|
Sudoers option: !insults |
|
|
--with-iologdir[=DIR] |
--with-iologdir[=DIR] |
By default, sudo stores I/O log files in either /var/log/sudo-io, |
By default, sudo stores I/O log files in either /var/log/sudo-io, |
/var/adm/sudo-io, or /usr/log/sudo-io. If this option is |
/var/adm/sudo-io, or /usr/log/sudo-io. If this option is |
specified, I/O logs will be stored in the indicated directory |
specified, I/O logs will be stored in the indicated directory |
instead. |
instead. |
|
Sudoers option: iolog_dir |
|
|
--disable-authentication | --with-lecture=no, --without-lecture |
By default, sudo requires the user to authenticate via a | Don't print the lecture the first time a user runs sudo. |
password or similar means. This options causes sudo to | Sudoers option: !lecture |
*not* require authentication. It is possible to turn | |
authentication back on in sudoers via the PASSWD attribute. | |
|
|
--disable-root-sudo | --with-logfac=FACILITY |
Don't let root run sudo. This can be used to prevent people from | Determines which syslog facility to log to. This requires |
"chaining" sudo commands to get a root shell by doing something | a 4.3BSD or later version of syslog. You can still set |
like "sudo sudo /bin/sh". | this for ancient syslogs but it will have no effect. The |
| following facilities are supported: authpriv (if your OS |
| supports it), auth, daemon, user, local0, local1, local2, |
| local3, local4, local5, local6, and local7. |
| Sudoers option: syslog |
|
|
--enable-gss-krb5-ccache-name | --with-logging=TYPE |
Use the gss_krb5_ccache_name() function to set the Kerberos | How you want to do your logging. You may choose "syslog", |
V credential cache file name. By default, sudo will use | "file", or "both". Setting this to "syslog" is nice because |
the KRB5CCNAME environment variable to set this. While | you can keep all of your sudo logs in one place (see the |
gss_krb5_ccache_name() provides a better API to do this it | sample.syslog.conf file). The default is "syslog". |
is not supported by all Kerberos V and SASL combinations. | Sudoers options: syslog and logfile |
|
|
--enable-log-host | --with-loglen=NUMBER |
Log the hostname in the log file. | Number of characters per line for the file log. This is only used if |
| you are to "file" or "both". This value is used to decide when to wrap |
| lines for nicer log files. The default is 80. Setting this to 0 |
| will disable the wrapping. |
| Sudoers options: loglinelen |
|
|
--enable-noargs-shell | --with-logpath=PATH |
If sudo is invoked with no arguments it acts as if the "-s" flag had | Override the default location of the sudo log file and use |
been given. That is, it runs a shell as root (the shell is determined | "path" instead. By default will use /var/log/sudo.log if |
by the SHELL environment variable, falling back on the shell listed | there is a /var/log dir, falling back to /var/adm/sudo.log |
in the invoking user's /etc/passwd entry). | or /usr/adm/sudo.log if not. |
| Sudoers option: logfile |
|
|
--enable-shell-sets-home | --with-long-otp-prompt |
If sudo is invoked with the "-s" flag the HOME environment variable | When validating with a One Time Password scheme (S/Key or |
will be set to the home directory of the target user (which is root | OPIE), a two-line prompt is used to make it easier to cut |
unless the "-u" option is used). This option effectively makes the | and paste the challenge to a local window. It's not as |
"-s" flag imply "-H". | pretty as the default but some people find it more convenient. |
| Sudoers option: long_otp_prompt |
|
|
--disable-path-info | --with-mail-if-no-user=no, --without-mail-if-no-user |
Normally, sudo will tell the user when a command could not be found | Normally, sudo will mail to the "alertmail" user if the user invoking |
in their $PATH. Some sites may wish to disable this as it could | sudo is not in the sudoers file. This option disables that behavior. |
be used to gather information on the location of executables that | Sudoers option: mail_no_user |
the normal user does not have access to. The disadvantage is that | |
if the executable is simply not in the user's path, sudo will tell | |
the user that they are not allowed to run it, which can be confusing. | |
|
|
--enable-zlib[=location] | --with-mail-if-no-host |
Enable the use of the zlib compress library when storing | Send mail to the "alermail" user if the user exists in the sudoers |
I/O log files. If specified, location is the base directory | file, but is not allowed to run commands on the current host. |
containing the zlib include and lib directories. The special | Sudoers option: mail_no_host |
values "system" and "builtin" can be used to indicate that | |
the system version of zlib should be used or that the version | |
of zlib shipped with sudo should be used instead. | |
If this option is not specified, configure will use the | |
system zlib if it is present. | |
|
|
--disable-zlib | --with-mail-if-noperms |
Disable the use of the zlib compress library when storing | Send mail to the "alermail" user if the user is allowed to use sudo but |
I/O log files. | the command they are trying is not listed in their sudoers file entry. |
| Sudoers option: mail_no_perms |
|
|
--enable-warnings | --with-mailsubject="SUBJECT OF MAIL" |
Enable compiler warnings when building sudo with gcc. | Subject of the mail sent to the "mailto" user. The token "%h" |
| will expand to the hostname of the machine. |
| Default is "*** SECURITY information for %h ***". |
| Sudoers option: mailsub |
|
|
--enable-werror | --with-mailto=USER|MAIL_ALIAS |
Enable the -Werror compiler option when building sudo with gcc. | User (or mail alias) that mail from sudo is sent to. |
| This should go to a sysadmin at your site. The default is "root". |
| Sudoers option: mailto |
|
|
--disable-hardening | --with-passprompt="PASSWORD PROMPT" |
Disable the use of compiler/linker exploit mitigation options | Default prompt to use when asking for a password; can be overridden |
which are enabled by default. This includes compiling with | via the -p option and the SUDO_PROMPT environment variable. Supports |
_FORTIFY_SOURCE defined to 2, building with -fstack-protector | the "%H", "%h", "%U" and "%u" escapes as documented in the sudo |
and linking with -zrelro, where supported. | manual page. The default value is "Password:". |
| Sudoers option: passprompt |
|
|
--disable-pie | --with-password-timeout=NUMBER |
Disable the creation of position independent executables (PIE) | Number of minutes before the sudo password prompt times out. |
even when the compiler and linker support them. | The default is 5, set this to 0 for no password timeout. |
By default, sudo will be built as a PIE where possible. | Sudoers option: passwd_timeout |
|
|
--enable-admin-flag | --with-passwd-tries=NUMBER |
Enable the creation of an Ubuntu-style admin flag file | Number of tries a user gets to enter his/her password before sudo logs |
the first time sudo is run. | the failure and exits. The default is 3. |
| Sudoers option: passwd_tries |
|
|
--disable-env-reset | --with-pc-insults |
Disable environment resetting. This sets the default value | Replace politically incorrect insults with less objectionable ones. |
of the "env_reset" Defaults option in sudoers to false. | |
|
|
--enable-nls[=location] | --with-runas-default=USER |
Enable natural language support using the gettext() family | The default user to run commands as if the -u flag is not specified |
of functions. If specified, location is the base directory | on the command line. This defaults to "root". |
containing the libintl include and lib directories. If | Sudoers option: runas_default |
this option is not specified, configure will look for the | |
gettext() family of functions in the standard C library | |
first, then check for a standalone libintl (linking with | |
libiconv as needed). | |
|
|
--disable-nls | --with-secure-path[=PATH] |
Disable natural language support. By default, sudo will | Path used for every command run from sudo(8). If you don't trust the |
use the gettext() family of functions, if available, to | people running sudo to have a sane PATH environment variable you may |
implement messages in the invoking user's native language. | want to use this. Another use is if you want to have the "root path" |
Note that translations do not exist for all languages. | be separate from the "user path." You will need to customize the path |
| for your site. NOTE: this is not applied to users in the group |
| specified by --with-exemptgroup. If you do not specify a path, |
| "/bin:/usr/ucb:/usr/bin:/usr/sbin:/sbin:/usr/etc:/etc" is used. |
| Sudoers option: secure_path |
|
|
Shadow password and C2 support | --with-sendmail=PATH |
============================== | Override configure's guess as to the location of sendmail. |
| Sudoers option: mailerpath |
|
|
Shadow passwords (also included with most C2 security packages) are | --with-sendmail=no, --without-sendmail |
supported on most major platforms for which they exist. The | Do not use sendmail to mail messages to the "mailto" user. |
`configure' script will attempt to determine if your system can use | Use only if you don't run sendmail or the equivalent. |
shadow passwords and include support for them if so. Shadow password | Sudoers options: !mailerpath or !mailto |
support is now compiled in by default (it doesn't hurt anything if you | |
don't have them configured). To disable the shadow password support, | |
use the --disable-shadow option to configure. | |
|
|
Shadow passwords are known to work on the following platforms: | --with-sudoers-mode=MODE |
| File mode for the sudoers file (octal). Note that if you |
| wish to NFS-mount the sudoers file this must be group |
| readable. This value may overridden at run-time in the |
| sudo.conf file. The default mode is 0440. |
|
|
SunOS 4.x | --with-sudoers-uid=UID |
Solaris 2.x | User id that "owns" the sudoers file. Note that this is |
HP-UX >= 9.x | the numeric id, *not* the symbolic name. This value may |
Ultrix 4.x | overridden at run-time in the sudo.conf file. The default |
Digital UNIX | is 0. |
IRIX >= 5.x | |
AIX >= 3.2.x | |
Linux | |
SCO >= 3.2.2 | |
Pyramid DC/OSx | |
UnixWare | |
SVR4 (and variants using standard SVR4 shadow passwords) | |
4.4BSD based systems (including OpenBSD, NetBSD, FreeBSD, and Mac OS X) | |
Systems using SecureWare's C2 security. | |
|
|
OS dependent notes | --with-sudoers-gid=GID |
================== | Group id that "owns" the sudoers file. Note that this is |
| the numeric id, *not* the symbolic name. This value may |
| overridden at run-time in the sudo.conf file. The default |
| is 0. |
|
|
Linux: | --with-timeout=NUMBER |
PAM and LDAP headers are not installed by default on most Linux | Number of minutes that can elapse before sudo will ask for a passwd |
systems. You will need to install the "pam-dev" package if | again. The default is 5, set this to 0 to always prompt for a password. |
/usr/include/security/pam_appl.h is not present on your system. | Sudoers option: timestamp_timeout |
If you wish to build with LDAP support you will also need the | |
openldap-devel package. | |
|
|
Versions of glibc 2.x previous to 2.0.7 have a broken lsearch(). | --with-tty-tickets=no, --without-tty-tickets |
You will need to either upgrade to glibc-2.0.7 or use sudo's | By default, sudo uses a different ticket file for each user/tty combo. |
version of lsearch(). To use sudo's lsearch(), comment out | With this option disabled, a single ticket will be used for all |
the "#define HAVE_LSEARCH 1" line in config.h and add lsearch.o | of a user's login sessions. |
to the LIBOBJS line in the Makefile. | Sudoers option: tty_tickets |
|
|
If you are using a Linux kernel older than 2.4 it is not possible | --with-umask=MASK |
to access the sudoers file via NFS. This is due to a bug in | Umask to use when running the root command. The default is 0022. |
the Linux client-side NFS implementation that has since been | Sudoers option: umask |
fixed. There is a workaround on the sudo ftp site, linux_nfs.patch, | |
if you need to NFS-mount sudoers on older Linux kernels. | |
|
|
Solaris 2.x: | --with-umask=no, --without-umask |
You need to have a C compiler in order to build sudo. Since | Preserves the umask of the user invoking sudo. |
Solaris 2.x does not come with one by default this means that | Sudoers option: !umask |
you either need to install the Sun Studio compiler suite, | |
available for free from www.sun.com, or have a copy of the GNU | |
C compiler (gcc) which is distributed on the Solaris Companion | |
CD. You can also get them from various places on the net, | |
including http://www.sunfreeware.com/ | |
NOTE: sudo will *not* build with the sun C compiler in BSD | |
compatibility mode (/usr/ucb/cc). Sudo is designed to | |
compile with the standard C compiler (or gcc) and will | |
not build correctly with /usr/ucb/cc. You can set the | |
CC environment variable to the non-ucb compiler when | |
running `configure' if it is not the first cc in your | |
path. Some sites link /usr/ucb/cc to gcc; configure will | |
not notice this and still refuse to use /usr/ucb/cc, so | |
make sure gcc is also in your path if your site is setup | |
this way. | |
Also: Older versions of Solaris come with a broken syslogd. | |
If you have having problems with sudo logging you should | |
make sure you have the latest syslogd patch installed. | |
This is a problem for Solaris 2.4 and 2.5 at least. | |
|
|
Mac OS X: | --with-umask-override |
The pseudo-tty support in the Mac OS X kernel has bugs related | Use the umask specified in sudoers even if it is less restrictive |
to its handling of the SIGTSTP, SIGTTIN and SIGTTOU signals. | than the user's. The default is to use the intersection of the |
It does not restart reads and writes when those signals are | user's umask and the umask specified in sudoers. |
delivered. This may cause problems for some commands when I/O | Sudoers option: umask_override |
logging is enabled. The issue has been reported to Apple and | |
is bug id #7952709. | |
|
|
|
OS dependent notes |
|
================== |
|
|
HP-UX: |
HP-UX: |
The default C compiler shipped with HP-UX is not an ANSI compiler. |
The default C compiler shipped with HP-UX is not an ANSI compiler. |
You must use either the HP ANSI C compiler or gcc to build sudo. |
You must use either the HP ANSI C compiler or gcc to build sudo. |
Line 776 HP-UX:
|
Line 791 HP-UX:
|
|
|
sudo session required libpam_hpsec.so.1 bypass_umask bypass_last_login |
sudo session required libpam_hpsec.so.1 bypass_umask bypass_last_login |
|
|
Digital UNIX: | Linux: |
By default, sudo will use SIA (Security Integration Architecture) | PAM and LDAP headers are not installed by default on most Linux |
to validate a user. If you want to use an alternative authentication | systems. You will need to install the "pam-dev" package if |
method that does not go through SIA, you need to use the | /usr/include/security/pam_appl.h is not present on your system. |
--disable-sia option to configure. If you use gcc to compile | If you wish to build with LDAP support you will also need the |
you will get warnings when building interfaces.c. These are | openldap-devel package. |
harmless but if they really bug you, you can edit | |
/usr/include/net/if.h around line 123, right after the comment: | |
/* forward decls for C++ */ | |
change the line: | |
#ifdef __cplusplus | |
to: | |
#if defined(__cplusplus) || defined(__GNUC__) | |
If you don't like the idea of editing the system header file | |
you can just make a copy in gcc's private include tree and | |
edit that. | |
|
|
AIX 3.2.x: | Mac OS X: |
I've had various problems with the AIX C compiler producing | The pseudo-tty support in the Mac OS X kernel has bugs related |
incorrect code when the -O flag was used. When optimization | to its handling of the SIGTSTP, SIGTTIN and SIGTTOU signals. |
is not used, the problems go away. Gcc does not appear | It does not restart reads and writes when those signals are |
to have this problem. | delivered. This may cause problems for some commands when I/O |
| logging is enabled. The issue has been reported to Apple and |
| is bug id #7952709. |
|
|
SCO ODT: | Solaris: |
You'll probably need libcrypt_i.a available via anonymous ftp | You need to have a C compiler in order to build sudo. Since |
from sosco.sco.com. The necessary files are /SLS/lng225b.Z | Solaris does not come with one by default this means that you |
and /SLS/lng225b.ltr.Z. | either need to either install the Solaris Studio compiler suite, |
| available for free from www.oracle.com, or install the GNU C |
| compiler (gcc) which is can be installed via the pkg utility |
| on Solaris 11 and higher and is distributed on the Solaris |
| Companion CD for older Solaris releases. You can also download |
| gcc packages from http://www.opencsw.org/packages/CSWgcc4core/ |
|
|
SunOS 4.x: |
SunOS 4.x: |
SunOS does not ship with an ANSI C compiler. You will need to |
SunOS does not ship with an ANSI C compiler. You will need to |
Line 810 SunOS 4.x:
|
Line 822 SunOS 4.x:
|
|
|
The /bin/sh shipped with SunOS blows up while running configure. |
The /bin/sh shipped with SunOS blows up while running configure. |
You can work around this by installing bash or zsh. If you |
You can work around this by installing bash or zsh. If you |
have bash or zsh in your path, configure will use it instead | have bash or zsh in your path, configure will use it automatically. |
automatically. | |
| |
ULTRIX 4.x: | |
ULTRIX does not ship with an ANSI C compiler. You will need to | |
install an ANSI compiler such as gcc to build sudo. | |
| |
The /bin/sh shipped with ULTRIX blows up while running configure. | |
You can work around this by installing bash or zsh. If you | |
have bash or zsh in your path, configure will use it instead | |
automatically. | |
| |
ULTRIX ships with the 4.2BSD syslog(3) which does not | |
allow things like logging different facilities to different | |
files, redirecting logs to a single loghost and other niceties. | |
You may want to just grab and install: | |
ftp://www.sudo.ws/pub/sudo/misc/jtkohl-syslog-complete.tar.gz | |
(available via anonymous ftp) which is a port if the 4.3BSD | |
syslog/syslogd that is backwards compatible with the Ultrix version. | |
I recommend it highly. If you do not do this you probably want | |
to run configure with --with-logging=file | |