How do you enable sudo, disable root, and limit access in Linux / Cent OS?

After googling sometime, I have followed the steps indicated here and made it work in CENT OS 5. Hence, I am sharing this experience and step for you to learn. The steps are simple and easy to follow once you understand the concept of it.

Cent OS differs from many other distros by enabling root account during setup. When there is a need to perform administrative task, just run the command with sudo and easily prevent the risk of abusing root privileges and doing stupid things. Following this guide, I was able to make this work on CentOS. Enabling sudo in other OS follows similar steps.

This is only for novice or first comers or just Linux learners. I am not going to you describe advance sudo functionality o setup.

Every distro is by default sudo enabled. You have a file /etc/sudoers, in which the user accounts are disabled, especially in CENT OS. All you need to do is edit the file, remove the comments that activates the sudo accounts. Mostly, you add a group inside sudo file and attach the users to the group (regular way in /etc/group ). Since the group name is listed (enabled) in /etc/sudoers all the users will have the same sudo privilege.

The /etc/sudoers is a read only file. This can be edited by vim editor. By using vim editor, it automatically allows you to edit the file even though it is read only for root. BTW, you need to edit as a root user!

1. First, log in as root account. You can switch to root account from any account by running su and typing the root password.
2. Enabling sudo. If you are not comfortable with vim, run

first. Now run

The lines starting with # are comment lines and will be ignored. Just uncomment the following line:

by removing the # at the beginning. This line means that anybody in the group wheel can use sudo to run anything from anywhere.
3. Add an account to group wheel. For example, if the account you use to perform administrative task is isteering, run

Now you can sudo from user isteering
4. Disable root account. This is done by running passwd to lock the account:

This suggestion may work well for a server setup, but it has the unfortunate side effect of locking the user out from a desktop setup of CentOS when attemping admin functions through GNOME. My suggestion instead of locking the root password is to disable root logins through ssh by adding the following line to /etc/ssh/sshd_config
PermitRootLogin no
This still permits the root user to login at the workstation. If physical access is an issue, locking the account via passwd lockout is probably a better choice.

It is quite obvious after we perform the above steps, we have just created a second root account: the user isteering is exactly the same as root user, just having a different name. So we have not added much protection, if the attacker can guess the name of this new account. So you might want to consider limiting where the user can log in from. Use your favorite editor to edit file /etc/security/access.conf. Add the following lines for the admin group:

This will deny user in group wheel to log in from anywhere but 192.168.1. subnetwork (note the suffix dot) or host 72.14.207.99. You still need to add this line

to /etc/pam.d/sshd to tell SSH server to consult the access control, otherwise SSH server by default will ignore this access control mechanism built in PAM.

Otherwise, you can change the file permission chmod 777 /etc/sudoers, edit the changes, and change back chmod 440 /etc/sudoers. I tested this with cent OS, it is working.

Reference:
http://www.linuxquestions.org/questions/linux-newbie-8/how-to-edit-sudoers-file-using-visudo-597400/
http://edipage.wordpress.com/2008/09/30/quickly-secure-centos-5-by-enabling-sudo-disabling-root-and-limiting-access/