12

I'm a systems admin for a company and was thrown into a horribly configured server. In the midst of my refactoring I was adding users to my /etc/sudoers file. I seem to have accidentally removed my server admin account from the sudoers file access.

I know what I did wrong (i accidentally commented out the %admin line) question being, how can I reinstate my server admin access in the file without having to restart anything.

Here's how it looks right now:

##
## User privilege specification
##
root ALL=(ALL) ALL
#%admin  ALL=(ALL) ALL
%superuser ALL=(ALL) ALL
"user1" ALL=(ALL) ALL
"user2" ALL=(ALL) ALL

Also note that my users do not have permission for sudo for some reason:

Realtor-Station-3-27:~ user1$ sudo -i

WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:
user1 is not in the sudoers file.  This incident will be reported.
Realtor-Station-3-27:~ user1$
Improve this question
1
  • 5
    Boot into single user mode and fix the file :-)
    – nohillside ♦
    Commented Mar 6, 2018 at 16:49

4 Answers 4

Reset to default
16

If you have access to finder and a system administrator account, you can fix this without a reboot by leveraging these.

Open up your finder and go to /etc. In here, you can view the details of the sudoers file, including permissions - screenshot below.

screenshot showing where to change permissions on the sudoers file in Finder

Change the permissions for "everyone" here to Read & Write.

At this time, you can edit yourself back into the file with any text editor. You will have to return permissions for "everyone" back to No Access before sudo will allow you to perform a sudo.

Improve this answer
2
  • I found this answer more useful than doing it over CLI.
    – Quirk
    Commented Mar 5, 2019 at 9:43
  • works for mac. you need to revert the access change after done
    – Tony
    Commented Jun 24, 2020 at 22:28
6

Once you get things working again, you should make sure these lines exists at the bottom of your /etc/sudoers file:

## Read drop-in files from /private/etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /private/etc/sudoers.d

Then make sure that you have a /etc/sudoers.d/ directory. This is how mine looks:

> ls -ld /etc/sudoers.d
drwxr-xr-x 3 root wheel 96 Jul 31 20:59 /etc/sudoers.d/

Now you can effectively make changes to the sudoers file by adding a new file into the /etc/sudoers.d/ folder. For example, I named mine tjluoma so the file /etc/sudoers.d/tjluoma (note the lack of filename extension, which seems to be a requirement) has my modifications to sudoers but I don’t risk causing global problems to sudo if there is a syntax error.

You can verify that your personal sudoers file is being read by using sudo visudo -c which will list all of the files that sudo will use, as shown here:

> sudo visudo -c
/etc/sudoers: parsed OK
/private/etc/sudoers.d/tjluoma: parsed OK

(Note that /private/etc/sudoers.d/ and /etc/sudoers.d/ refer to the same folder.)

Of course the best way to make changes to /etc/sudoers or your personal sudoers file is with sudo visudo or sudo visudo -f /private/etc/sudoers.d/tjluoma because it will check the syntax as part of the process of editing / saving, but we’ve all probably been guilty of not following that step 😀

Improve this answer
1
  • Thank you for mentioning the requirement to NOT have filename extension for files in /etc/sudoers.d/ — this was the trouble in my case.
    – Vlad GURDIGA
    Commented Sep 16, 2022 at 9:22
2

I was unsuccessful in replacing the /etc/sudoers file with a fresh new file and changing its permission to root:wheel and 0440.

Finally I had to go to Recovery Mode (restart → ⌘ CommandR)

  1. Mount Macintosh HD through Disk Utility
  2. Go to Terminal through Utilities
  3. cd /Macintosh HD/private/etc
  4. Edit sudoers file to correct the mistakes.
  5. Save and change permissions if needed. sudoers file needs root:wheel. If its not, sudo won't be run. chown root:wheel sudoers
  6. I had also changed the permissions with chmod 0440 sudoers since I initially removed sudoers and created a fresh copy when I was logged in.
Improve this answer
1
  • I cannot edit /etc/sudoers because Permission Denied
    – IgorGanapolsky
    Commented Aug 2, 2022 at 14:45
0

So after banging my head for 2hrs and 100 different articles, I managed to brute my way through.

  1. Use finder to change permissions of sudoers file. Right click>Get info>Sharing and Permissions.Change it for all parties including 'everyone' to read & write. Not sure if this step is necessary though.
  2. Delete sudoers file from /etc/ using finder after making a copy of it.
  3. Shift new sudoers file back to /etc/
  4. Use this command to restore your sudoers file https://apple.stackexchange.com/a/394943
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .