26

I am looking for where the default Amazon AMI linux image sets up the privileges for the default ec2-user account.

After logging in with this account I can use sudo successfully. Checking via the sudoers file, which I open by running visudo (with no other options) I see a few default settings and permissions for root ALL ALL

So ... Where is the permissions for ec2-user assigned?

I have not yet tried to add a new permission but ultimately I want to resign ec2-user for systems management tasks and use a non-full root user for administering the applications (stop and start mysql, httpd, edit apache's vhost files, and upload / edit web content under the web root)

Johan
  • 447
  • 1
  • 5
  • 14

2 Answers2

28

It's in /etc/sudoers.d/cloud-init. I, too, delete it from my production systems as soon as I can.

It is included by virtue of the line

#includedir /etc/sudoers.d

in the /etc/sudoers file. Note that, as it says, that leading # isn't treated as a comment sign. On some of my servers, it's also in /etc/sudoers.d/90-cloud-init-users; it may be safest to userdel the ec2-user user.

MadHatter
  • 79,770
  • 20
  • 184
  • 232
  • Yes it is. Now why don't you fix your answer so that I can award you the credit? – Johan May 29 '14 at 09:06
  • 1
    What on _earth_ were the `sudo` devs thinking [with that #include syntax](https://www.sudo.ws/man/1.8.13/sudoers.man.html#Including_other_files_from_within_sudoers) when the comment character is `#`? – DaveGauer May 19 '18 at 23:02
  • 1
    @DaveGauer it's using the same syntax as a C preprocessor (`#include "file"` or `#include `). But yes, that's a bad choice for a config file. – Tony Cesaro Jun 29 '18 at 21:38
3

Indeed it is a file from /etc/sudoers.d/ 

From the master sudoers file, the very last part:
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

Specifically the small bit which reads # here does not mean a comment

And then:

[root@webmaster ec2-user]# cd /etc/sudoers.d/
[root@webmaster sudoers.d]# ls -l
total 4
-r--r----- 1 root root 88 May  5 09:16 cloud-init
[root@webmaster sudoers.d]# grep ec2-user *
ec2-user ALL = NOPASSWD: ALL
# User rules for ec2-user
ec2-user ALL=(ALL) NOPASSWD:ALL

Voila.

Johan
  • 447
  • 1
  • 5
  • 14