sudo & Privilege Escalation

sudo

sudo runs a command as another user (root by default) with per-command logging and no shared root password.

CommandAction
sudo cmdRun cmd as root
sudo -u alice cmdRun as alice
sudo -iRoot login shell
visudoSafely edit sudo config

Config lives in /etc/sudoers and /etc/sudoers.d/. Always edit with visudo - it validates syntax before saving.

# /etc/sudoers.d/devs
alice   ALL=(ALL:ALL) ALL              # full sudo
%devs   ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx
Exam tip: Membership in the sudo group (Debian) or wheel group (RHEL) grants admin rights. A % prefix in sudoers means a group.