1

I have a company MacBook Pro. I am sudoer and I can do anything that requires admin privileges when I'm connected to the company network. But I can't when I'm home. How is that possible?

Improve this question

1 Answer 1

Reset to default
2

This special behavior is probably related to the sudoers file.

By modifying this file in /private/etc/ one can restrict the sudoers to particular networks or single IP-addresses:

The common user privileges specs are as following:

# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL
        |    |    |command
        |    |as user
        | hosts

This means: the users of the group admin can sudo any command as any user ("Runas") from all networks.

By specifying a restricted host/network in the host alias specification earlier in the same file this may be changed:

# Host alias specification

Host_Alias      COMPNET = 172.17.0.0/255.255.0.0

Modifying the user privilege specifications to:

root    ALL=(ALL) ALL
%admin  COMPNET=(ALL) ALL

doesn't allow you to execute sudo in your home network if the IP-address is not in the above range (e.g. your home network provides DHCP leases in the 192.168.0.0/24 range and none of the other interfaces have an IP in the above 172.17.0.0/255.255.0.0 network). Back in the company network (e.g. with a DHCP range 172.17.5.0/24) sudoing works again.

Improve this answer
6
  • Don't edit it on your own. Set EDITOR and use visudo as root.
    – bot47
    Feb 16, 2016 at 6:20
  • I have those privileges and can do sudo now. However, I still cannot install applications the usual way...
    – Bob
    Feb 18, 2016 at 20:27
  • @Bob My answer is just one possible answer. You'd have to add additional informations to your question. How did you get back your sudo privileges?
    – klanomath
    Feb 18, 2016 at 20:30
  • by adding my name in sudoers under /private
    – Bob
    Feb 18, 2016 at 20:31
  • @Bob can you post the original content of your sudoers flie? Or does it contain any secret data (like company network data, user groups etc.)? You may have to sanitize the file before posting it here!
    – klanomath
    Feb 18, 2016 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .