1

I have a company MacBook Pro. I am sudoer and I can do anything that requires admin privileges when I'm connected to the company network. But I can't when I'm home. How is that possible?

2

This special behavior is probably related to the sudoers file.

By modifying this file in /private/etc/ one can restrict the sudoers to particular networks or single IP-addresses:

The common user privileges specs are as following:

# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL
        |    |    |command
        |    |as user
        | hosts

This means: the users of the group admin can sudo any command as any user ("Runas") from all networks.

By specifying a restricted host/network in the host alias specification earlier in the same file this may be changed:

# Host alias specification

Host_Alias      COMPNET = 172.17.0.0/255.255.0.0

Modifying the user privilege specifications to:

root    ALL=(ALL) ALL
%admin  COMPNET=(ALL) ALL

doesn't allow you to execute sudo in your home network if the IP-address is not in the above range (e.g. your home network provides DHCP leases in the 192.168.0.0/24 range and none of the other interfaces have an IP in the above 172.17.0.0/255.255.0.0 network). Back in the company network (e.g. with a DHCP range 172.17.5.0/24) sudoing works again.

  • Don't edit it on your own. Set EDITOR and use visudo as root. – Max Ried Feb 16 '16 at 6:20
  • I have those privileges and can do sudo now. However, I still cannot install applications the usual way... – Bob Feb 18 '16 at 20:27
  • @Bob My answer is just one possible answer. You'd have to add additional informations to your question. How did you get back your sudo privileges? – klanomath Feb 18 '16 at 20:30
  • by adding my name in sudoers under /private – Bob Feb 18 '16 at 20:31
  • @Bob can you post the original content of your sudoers flie? Or does it contain any secret data (like company network data, user groups etc.)? You may have to sanitize the file before posting it here! – klanomath Feb 18 '16 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .