Mac OS X Leopard - ARCAism

By default, sudo will allow root and any user in the admin group to utilize it. If a nonadmin
user attempts to use sudo, instead of their chosen command being executed, they will be presented
with the following warning:
user is not in the sudoers file. This incident will be reported.
To run a command as a user other than root, sudo offers the -u option, which you would use
as follows:
sudo -u username command
On the slight chance that you really must execute a series of commands as another user and
you’d like to maintain the user state for an extended period of time, sudo offers a the -s option,
which will in effect start the shell as the specified user. Since this command starts a shell as the
specified user or root, no additional command is necessary. By default, this is the equivalent of
using the older su command. If you must use this (and it’s recommended that you don’t), it’s
important to remember to quit as soon as you are done—otherwise, you will remain in root state
and are more likely to do something regrettable (or forget you are logged in as root and walk
away from your computer for a cup of coffee or something and allow someone else do something
perhaps even more regrettable)!
NOTE Before there was sudo, there was su (substitute user). Rather than taking a command,
su just dropped you into a shell as root or the specified user. For whatever reason, many oldtime
UNIX users still swear by the su command, and while these are generally intelligent
people who can perform amazing computer tasks in their sleep, their stubbornness in regard
to su is misplaced. You shouldn’t use su on the Mac (and yes, it is there). su was written in a
time of relative innocence, when mail servers didn’t require passwords and spam filters didn’t
exist, when virus protection wasn’t a billion-dollar industry, and “god” was an appropriate (and
sadly all too common) password for the root user. Anyway, those days are gone, and su just
doesn’t provide the features and, more importantly, the security that sudo provides (such as
fine-grained per-user and per-group customizability, sophisticated checks on timestamps and
files to assure that nobody has tampered with the file, and more).
sudoers
The sudo defaults are sensible and appropriate for most computer uses. However, for servers or
other computers with many users, sudo can be coaxed into providing very specific, fine-grained
privileges to individual users or groups. To do this requires editing the /etc/sudoers file. The
catch is that to edit this file, you must have root privileges and you must use a special editor
named visudo. visudo is really a special mode of the Vi editor—or more specifically, Vim, which
stands for vi improved, and is installed on Leopard in place of Vi. The easiest way to accomplish
all this is to merely use the following:
Leopard:~ scott$ sudo visudo
Password:
CHAPTER 18 INTRODUCING DARWIN AND THE SHELL 311
This will immediately open up the sudoers file to be edited (assuming you understand how
Vi works, which if you don’t right now, I will explain in the next section).
Sadly, a discussion on the many specific tweaks that can be made to this file would extend
far beyond the confines of this book. However, typing man sudoers will bring you to the man page
for this particular file and will explain in detail things like the extended Backus-Naur form, what
exactly it means, and how to put it to use.