sudoers Rule Generator
Generate a sudoers drop-in that lets a user or group run specific commands as root, optionally without a password, with warnings for relative paths and wildcards.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a sudoers rule
Output
sudoers drop-in
208 characters
Install with sudo visudo -f /etc/sudoers.d/deploy, which refuses to save a file with a syntax error; a broken sudoers file locks everyone out of sudo. Files in sudoers.d whose names contain a dot or end in ~ are silently ignored. Check what a user may run with sudo -l -U deploy.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Grant commands, not shells
A deploy user that may run systemctl reload nginx cannot do anything else as root. A user that may run systemctl * or a text editor as root can get a root shell, because many programs can spawn one. The sudoers manual describes matching rules, including how arguments are compared.
Always use visudo
A syntax error in sudoers stops sudo working for everyone, and fixing it then needs a root password or recovery mode. visudo -f /etc/sudoers.d/deploy checks the file before saving. Files in sudoers.d whose names contain a dot are skipped silently, which is why the generator replaces dots.
