# /etc/sudoers - Sample configuration with various security settings

# Defaults specification
Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults    logfile="/var/log/sudo.log"
Defaults    lecture="always"
Defaults    timestamp_timeout=5
Defaults    requiretty

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin  ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Unrestricted sudo with password - should flag check 10
# john    ALL=(ALL) ALL

# Passwordless sudo for specific user - should flag check 1
# deploy  ALL=(ALL) NOPASSWD: ALL

# Specific command restrictions
%webadmins ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx

# Environment keep for specific users
Defaults:devuser    !env_reset

# Commented-out dangerous directives - should flag check 11
# Defaults    !authenticate
# Defaults    !requiretty
# NOPASSWD: ALL

# Root password prompt - should flag check 7
# Defaults    rootpw

# Insults enabled - should flag check 8
# Defaults    insults

# Included files
@includedir /etc/sudoers.d 
