sudo/sample.sudoers

#
# Sample /etc/sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for the details on how to write a sudoers file.
#

##
# User alias specification
##
User_Alias	FULLTIMERS=millert,mikef,dowdy
User_Alias	PARTTIMERS=bostley,jwfox,mccreary

##
# Runas alias specification
##
Runas_Alias	OP=root,operator

##
# Cmnd alias specification
##
Cmnd_Alias      DUMPS=/usr.sbin/dump,/usr.sbin/rdump,/usr.sbin/restore,\
		      /usr.sbin/rrestore,/usr/bin/mt
Cmnd_Alias	KILL=/usr/bin/kill
Cmnd_Alias	PRINTING=/usr.sbin/lpc,/usr.bin/lprm
Cmnd_Alias	SHUTDOWN=/usr.sbin/shutdown
Cmnd_Alias	HALT=/usr.sbin/halt,/usr.sbin/fasthalt
Cmnd_Alias	REBOOT=/usr.sbin/reboot,/usr.sbin/fastboot
Cmnd_Alias	SHELLS=/usr/bin/sh,/usr/bin/csh,/usr/bin/ksh,\
                       /usr/local/bin/tcsh,/usr.bin/rsh,\
                       /usr/local/bin/zsh
Cmnd_Alias	SU=/usr/bin/su
Cmnd_Alias	VIPW=/usr.sbin/vipw,/usr/sbin/vipw,/usr/bin/passwd

##
# Host alias specification
##
Host_Alias	SUN4=bruno,eclipse,moet,anchor
Host_Alias	SUN3=brazil,columbine
Host_Alias	DECSTATION=wilkinson,soma,dendrite,thang
Host_Alias 	DECALPHA=widget,thalamus,foobar
Host_Alias	HPSNAKE=boa,nag,python
Host_Alias	CUNETS=128.138.0.0/255.255.0.0
Host_Alias	CSNETS=128.138.243.0,128.138.204.0,128.138.242.0
Host_Alias	SEVERS=master,mail,www,ns

##
# User specification
##

# root and users in group wheel can run anything on any machine as any user
root		ALL=(ALL) ALL
%wheel		ALL=(ALL) ALL

# full time sysadmins can run anything on any machine without a password
FULLTIMERS	ALL=NOPASSWD:ALL
# part time sysadmins may run anything except root shells or su
PARTTIMERS	ALL=ALL,!SU,!SHELLS

# rodney may run anything except root shells or su on machines in CSNETS
rodney		CSNETS=ALL,!SU,!SHELLS

# smartguy may run any command on any host in CUNETS (call B address)
smartguy	CUNETS=ALL

# operator may run maintenance commands and anything in /usr/oper/bin/
operator	ALL=DUMPS,KILL,PRINTING,SHUTDOWN,HALT,REBOOT,/usr/oper/bin/

# joe may su only to operator
joe		ALL=SU operator

# pete may change passwords for anyone but root
pete		ALL=/usr/bin/passwd [A-z]*,!/usr/bin/passwd root

# bob may run anything except root shells or su on the sun3 and sun4 machines
# as any user in the Runas_Alias "OP" (contains root and operator)
bob		SUN4=(OP) ALL, !SU, !SHELLS:\
		SUN3=(OP) ALL, !SU, !SHELLS

# jim may run anything on machines in the biglab netgroup
jim		+biglab=ALL

# users in the secretaries netgroup need to help manage the printers
+secretaries	ALL=PRINTING

# fred can run commands as oracle by specifying -u oracle on command line
# without a password but cannot run su or any shells
fred		ALL=(oracle) NOPASSWD:ALL, !SU, !SHELLS

# john may su to anyone but root and flags are not allowed
john		ALL=SU [!-]*, !SU *root*

# killroy can run all but shells and su on all machines but those
# in the "SERVERS" Host_Alias
killroy		ALL,!SERVERS=ALL, !SU, !SHELLS