Table of Contents
Operating systems have a user with full privileges. However, since this user cannot be shared with the people logged into that system, they temporarily share some of their privileges with other users.
On Linux systems, the root user is the most authorized user. There is the sudo/wheel group for other users to use some of the privileges.
This group, which is called sudo in Debian based systems, is called wheel in Redhat and Arch base systems.
Users are taken to this group and authorized.
Configuring Wheel Group in sudoers File
In the sudoers file, the wheel group is disabled in many Linux distributions. Even if the user is in this group, the following warning appears when he wants to perform an authorized transaction:
foc@fedora:~$ sudo cat /etc/sudoers | grep wheel [sudo] password for foc: foc is not in the sudoers file. This incident will be reported.
Status in sudoers file:
## Allows people in group wheel to run all commands # %wheel ALL=(ALL) ALL ## Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL
This issue is resolved by removing the
# sign at the beginning of the
%wheel lines. Users who are in the wheel group in the first wheel line can run all commands with their own passwords. In the second wheel line, users do not need to enter a password:
#%wheel ALL=(ALL) NOPASSWD: ALL
Opening this line is not recommended for security reasons.
It can open the sudoers file with an editor(vi,nano etc):
[root@fedora faruk]# nano /etc/sudoers
or you can use visudo command:
[root@fedora faruk]# visudo
Open the first line in the sudoers file and try the same action again:
[root@fedora faruk]# visudo
foc@fedora:~$ sudo cat /etc/sudoers | grep wheel ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL # %wheel ALL=(ALL) NOPASSWD: ALL
Prevent wheel group users from changing root password
Wheel group users get root privileges temporarily. This authorization includes changing the root password. To prevent this, the sudoers file should be written like this:
%wheel ALL=(ALL) ALL, !/usr/bin/passwd root
After this operation, the user cannot change the root password even if user is in the wheel group:
faruk@fedora:~$ sudo passwd root Sorry, user faruk is not allowed to execute '/usr/bin/passwd root' as root on fedora.
Wheel Group Operations for Users
There are 2 methods to add/remove users to the wheel group. One is to use a command for this job, and the other is to manually edit the
Add/Remove Users to the wheel group by editing the group file
/etc/groups file with a text editor (vim, nano etc) in the terminal:
Type users in the wheel group line, one after the other, with a comma(",") between them.
Then, type sudo at the beginning of the commands you will type in the terminal to perform authorized action with the user. After the user enters his password, the action will take place:
[user1@fedora ]$ sudo cat /etc/sudoers [sudo] password for user1: ## Sudoers allows particular users to run various commands as ## the root user, without needing the root password. ...
To remove the user from the group, it is sufficient to delete the user from the wheel group line again. This step will prevent that user from taking authorized actions.
Add/Remove User from Wheel Group with Command
You have many alternatives for adding/removing users to the wheel group in Linux. When creating the user, you can create it by adding it to the wheel group with the adduser command:
[root@fedora faruk]# adduser user2 -G wheel
The added user is in the wheel group:
[root@fedora faruk]# cat /etc/group | grep wheel wheel:x:10:foc,faruk,user1,user2
[root@fedora faruk]# groups user2 user2 : user2 wheel
If the user is already added and you just want to put them in the wheel group, use the usermod command:
[root@fedora faruk]# usermod -aG wheel omer
The user is also included in the wheel group like this:
[root@fedora faruk]# cat /etc/group | grep wheel wheel:x:10:foc,faruk,user1,user2,omer
To remove the user from the wheel group, use the gpasswd command:
[root@fedora faruk]# gpasswd -d user1 wheel Removing user user1 from group wheel
This way user user1 is removed from wheel group:
[root@fedora faruk]# cat /etc/group | grep wheel wheel:x:10:foc,faruk,user2,omer
What you should do NEXT?
As we mentioned above, wheel group users are the most authorized users after root user. Care should be taken when adding/removing a user from this group.
Before adding/removing the wheel group, it should be ensured that the root password is known or you should switch to root user by logging in with an authorized user in a different terminal. Otherwise, you may lose all your privileges in that system.
In our article, we gave information about wheel, which is the super user authorization group in Linux.