USAGE for gen_sudoers.sh version r26.1.0.BETA.33444:
gen_sudoers.sh {-full|-limited} [-y [-f]] [-L <log>] [-D]
or
gen_sudoers.sh [-h|-man]
DESCRIPTION:
This script generates a sudoers file for the OS user that owns /p4/common,
which must be the same user that the p4* services runs as under systemd,
typically 'perforce'. The intent is to honor the principle of least
privilege. The generated sudoers file grants the access to user commands
reasonably needed for service management (e.g. service start/stop) and
diagnostics (e.g. lslocks, lsof), but no more.
By default, the sudoers file is generated for review. If the '-y'
option is specified, the newly generated files is installed as
the live sudoers file by copying to /etc/sudoers.d/<OSUSER> and
adjusting permissions to 0400.
If '-full' (full sudo) is specified, a one-line sudoers file is
generated that looks something like this:
perforce ALL=(ALL) NOPASSWD: ALL
Warning: Using '-full' does NOT honor the principle of least
privilege, and thus grants full sudo. This is not recommended
because it elevates access of remote super users.
If '-limited' is specified, a limited sudoers file is generated
granting only necessary access to the perforce user, and thus
honoring the principle of least privilege.
If the sudoers file already exits, it will not be updated unless
'-f' (force) is provided.
The limited sudoers option is recommended for production deployments.
This script must be executed as the root user.
OPTIONS:
-full
Specify '-full' to indicate that a sudoers file is to be generated
granting full root access to the server machine.
The '-full' or '-limited' option must be specified.
This option is discouraged as it is not as secure as the
'-limited' option.
-limited
Specify '-limited' to indicate that a sudoers file is to be
generated granting limited access to the server machine.
The '-full' or '-limited' option must be specified.
This option is recommended for optimal security.
-y This is confirmation to install the generated sudoers as the live
sudoers file.
-f Specify '-f' to overwrite an existing limited sudoers file,
/etc/sudoers.d/<OSUSER>
-L <log>
Specify the path to a log file, or the special value 'off' to disable
logging. By default, all output (stdout and stderr) goes to:
/root/gen_sudoers.<Datestamp>.log
NOTE: This script is self-logging. That is, output displayed on the screen
is simultaneously captured in the log file.
-D Enable bash 'set -x' extreme debugging verbosity.
HELP OPTIONS:
-h Display short help message
-man Display man-style help message
EXAMPLES:
EXAMPLE 1: Generate a limited sudoers file for review.
cd /p4/sdp/Server/Unix/setup
./gen_sudoers.sh -limited
EXAMPLE 2: Generate a limited sudoers file and install it.
cd /p4/sdp/Server/Unix/setup
./gen_sudoers.sh -limited -y
EXAMPLE 3: Generate a limited sudoers file and install it, replacing an
existing one.
cd /p4/sdp/Server/Unix/setup
./gen_sudoers.sh -limited -f -y
EXAMPLE 4: Generate a full sudoers file and install it, replacing an
cd /p4/sdp/Server/Unix/setup
./gen_sudoers.sh -full -f -y