sudo & PAM

sudoers syntax, NOPASSWD, visudo, PAM modules, pam_faillock, and /etc/pam.d structure.

Overview

Overview sudo and PAM are the two central pillars of privilege management and authentication on Linux systems. sudo controls who can run what commands as which user, while PAM (Pluggable Authentication Modules) controls how users authenticate.

sudo

sudo allows permitted users to run commands with elevated (or different-user) privileges. The policy is defined in /etc/sudoers and files in /etc/sudoers.d/.

Always edit sudoers with visudo — it locks the file, validates syntax before saving, and prevents saving a broken sudoers that would lock you out of sudo entirely.

Sudoers rule syntax:

Examples: - alice ALL=(ALL) ALL — alice can run any command as any user on any host - %ops ALL=(ALL) NOPASSWD: /bin/systemctl — ops group can run systemctl without password - deploy ALL=(www-data) NOPASSWD: /usr/bin/git — deploy user can run git as www-data only

PAM — Pluggable Authentication Modules

PAM is a framework that decouples authentication logic from applications. Instead of every application implementing its own authentication, they call PAM, which delegates to a stack of modules defined in /etc/pam.d/.

PAM module types: - auth — authenticate the user (verify password, check TOTP, etc.) - account — check account validity (expired? locked? time restrictions?) - session — set up/tear down the session (mount home dir, set limits, logging) - password — handle password changes

PAM control flags: required (must pass, continue stack), requisite (must pass, stop on failure), sufficient (if passes, stop stack), optional (result ignored unless only module).

Key concepts

visudo: Safe editor for /etc/sudoers. Locks the file, checks syntax before saving, and opens with $EDITOR. Never edit /etc/sudoers directly with vi — a syntax error locks everyone out of sudo.
NOPASSWD: Sudoers flag that allows a rule to execute without prompting for a password. Essential for automation. Always scope as narrowly as possible: NOPASSWD: /bin/systemctl restart myapp not NOPASSWD: ALL.
sudo -l: Lists the current user's sudo permissions. sudo -l -U username shows another user's permissions. Critical for auditing privilege escalation paths.
/etc/pam.d/: Directory of PAM configuration files, one per service (sshd, login, sudo, su). Each file is a stack of module rules with control flags.
pam_faillock: PAM module that locks accounts after N failed authentication attempts. Replacement for the older pam_tally2. Configure in /etc/security/faillock.conf and /etc/pam.d/. Unlock with faillock --reset --user username.
pam_limits: PAM module that applies resource limits from /etc/security/limits.conf at session start. Sets nofile (max open files), nproc (max processes), memlock, etc. Soft vs hard limits.

When to use it

Granting a deployment user permission to restart a service without a password — sudoers NOPASSWD rule
Locking out an account after 5 failed SSH attempts — pam_faillock in /etc/pam.d/sshd
Auditing who has sudo access on a system — sudo -l or parsing /etc/sudoers and /etc/sudoers.d/
Integrating LDAP authentication — pam_ldap or sssd modules in /etc/pam.d/
Setting per-user resource limits — pam_limits and /etc/security/limits.conf

Interview questions

Walk through the sudoers file format and set up a deployment user that can restart a specific service without a password.
How do you configure account lockout after failed SSH login attempts using PAM?