Doing things that require authority.
WHAT ROOT IS
The account with no restrictions.
WHY DIRECT ROOT LOGIN IS DISCOURAGED
It leaves no record of who acted, and one mistake is unbounded.
WHAT sudo PROVIDES
Running a single command with elevated privilege, as a named user, logged.
WHY THE LOGGING MATTERS
It answers who did what, which is unanswerable with shared root access.
WHAT TO CONFIGURE
Specific users or a group permitted to use it.
WHERE THAT IS DEFINED
The sudoers file, edited with visudo.
WHY visudo SPECIFICALLY
It checks the syntax before saving, and a broken sudoers file can lock everyone out.
WHAT TO RESTRICT WHERE POSSIBLE
Which commands each user may run elevated.
WHAT sudo WITH A DASH i DOES
Gives a full root shell.
WHEN TO USE IT
For a series of administrative commands.
WHAT TO BE CAREFUL ABOUT IN THAT SHELL
That everything you type has no safety net.
WHAT TO DISABLE
Direct SSH login as root, in favour of a named account with sudo.
WHAT TO NEVER DO
Share the root password Run applications as root Leave a root shell open and unattended
WHAT TO REVIEW
The sudo log, occasionally.
