Sudo vs Su – Understanding the Magic of ‘sudo su’

The root account is necessary on servers for sure, but I prefer granting sudo rights, especially when there are several users on the machine, and this for several reasons:

• I don't use sudo only to grant ALL rights for ALL commands, but also to grant specific rights as a specific user to specific commands.
• By assigning users to functional groups, I can manage their rights with these groups in sudoers instead of managing users individually.
• sudo accesses are logged in auth.log by default, including which users used sudo at what time.
• sudo allows to manage the configuration for several machines with one file.
• each user keeps their own password, so there is no need to change the root password when a user leaves.

As for managing it with scripts, new versions of sudo support inclusions, but I prefer to use puppet and set classes that concatenate sudoers contents.

Puppet can also be associated with Augeas to manage your sudoers file.

As you mentioned, the environment variables are removed by sudo, for security reasons.

But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers.

For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, simply edit your /etc/sudoers configuration file (always using visudo) and set the env_keep option to the appropriate users. If you want this option to be set for all users, use the Defaults line like this:

Defaults    env_keep+=SSH_AUTH_SOCK

man sudoers for more details.

You should now be able to do something like this (provided user1's public key is present in ~/.ssh/authorized_keys in user1@serverA and user2@serverB, and serverA's /etc/sudoers file is setup as indicated above):

user1@mymachine> eval `ssh-agent`  # starts ssh-agent
user1@mymachine> ssh-add           # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA    # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2     # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB         # goto user2@serverB w/o typing pwd again...
user2@serverB>                     # ...because forwarding still works