Sudo

A Short Introduction

Mon, 01 Jan 0001 00:00:00 +0000

Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. Sudo operates on a per-command basis, it is not a replacement for the shell. Its features include:

The ability to restrict the commands a user may run on a per-host basis.

README

Mon, 01 Jan 0001 00:00:00 +0000

The sudo philosophy

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done.

Where to find sudo

Before building sudo, make sure you have the current version. The latest sudo may always be gotten via anonymous ftp from ftp.sudo.ws in the directory /pub/sudo/ or from the sudo web site, https://www.sudo.ws/

Source Repo

Mon, 01 Jan 0001 00:00:00 +0000

Read-only access to the sudo source repository (from as far back as 1993) is available for checkout using git. If you are interested in contributing to sudo, the easiest way is probably via GitHub.

Cloning the sudo source repo via git

The main sudo source repo is located at git.sudo.ws. However, it is much faster to use one of the two official git mirrors, GitHub and Bitbucket.

Stable Release

Mon, 01 Jan 0001 00:00:00 +0000

The current stable release of the sudo 1.9 branch is version 1.9.17p2. For the sudo 1.8 branch, see legacy releases.

For full details see the ChangeLog file or view the commit history via git or GitHub.

Sudo 1.9.17p2

Fixed a bug introduced in sudo 1.9.16 that could result in sudo sending SIGHUP to all processes on the system in certain rare cases. The bug could manifest if sudo is running a command in a pseudo-terminal, sudo terminates the command due to an internal error, and the user’s terminal is revoked. GitHub issue #458.

Download Sudo

Mon, 01 Jan 0001 00:00:00 +0000

Sudo is distributed in source and and binary package formats. For information on how the binary packages are built, see building packages.

All source distributions and binary packages are signed with Todd’s PGP key. For .rpm and .deb packages, the signature is embedded in the package file itself. All other files use detached signatures (separate .sig files). Two keys are included in the file, the current pgp signing key with the fingerprint 59D1 E9CC BA2B 3767 04FD D35B A9F4 C021 CEA4 70FB and the old pgp signing key with the fingerprint CCB2 4BE9 E948 1B15 D341 5953 5A89 DFA2 7EE4 70C4. The signing keys are also available from the MIT public key server and the OpenPGP public key server.

Legacy Release

Mon, 01 Jan 0001 00:00:00 +0000

The sudo 1.8 branch is considered the legacy version. It receives no new features, only critical bug fixes. Users are highly encouraged to migrate to the sudo stable branch.

The current legacy release of sudo is 1.8.32.

For full details see the ChangeLog file or view the commit history via git or GitHub.

Sudo 1.8.32

Fixed a regression introduced in sudo 1.8.9 where the closefrom sudoers option could not be set to a value of 3. Bug #950.

Manual Pages (all versions)

Mon, 01 Jan 0001 00:00:00 +0000

Sudo 1.9.17 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.16 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.15 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.14 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.13 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.12 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.11 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.10 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.9 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.8 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.7 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.6 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.5 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.4 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.3 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.2 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.1 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.9.0 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.32 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Log Server Protocol Manual [pdf]
Sudo Log Server Configuration Manual [pdf]
Sudo Log Server Manual [pdf]
Sudo Plugin API [pdf]
Sudo Python Plugin API [pdf]
Sudo Log Client Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.31 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.30 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.29 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.28 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.27 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.26 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.25 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.24 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.23 ↕

Cvtsudoers Manual [pdf]
Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.22 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoers Time Stamp Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.21 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.20 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.19 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.18 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.17 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.16 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.15 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.14 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.13 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.12 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.11 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.10 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.9 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.8 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.7 ↕

Sudo Configuration Manual [pdf]
Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.8.6 ↕

Sudo Manual [pdf]
Sudo Plugin API [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

Sudo 1.7.10 ↕

Sudo Manual [pdf]
Sudoers LDAP Manual [pdf]
Sudoers Manual [pdf]
Sudoreplay Manual [pdf]
Visudo Manual [pdf]

README.LDAP

Mon, 01 Jan 0001 00:00:00 +0000

This file explains how to build the optional LDAP functionality of SUDO to store /etc/sudoers information. This feature is distinct from LDAP passwords.

For general sudo LDAP configuration details, see the sudoers.ldap manual that comes with the sudo distribution. A pre-formatted version of the manual may be found in the sudoers.ldap.cat file.

The sudo binary compiled with LDAP support should be totally backward compatible and be syntactically and source code equivalent to its non LDAP-enabled build.

Security Policy

Mon, 01 Jan 0001 00:00:00 +0000

The Sudo Project takes security seriously. If you believe you have found a security vulnerability in Sudo, you can report it to us as described below.

Reporting Security Issues

Do not report security vulnerabilities through public GitHub issues or Bugzilla.

Instead, report them via email to Todd.Miller@sudo.ws. You may encrypt your message with PGP if you would like. The current PGP key has the fingerprint 59D1 E9CC BA2B 3767 04FD D35B A9F4 C021 CEA4 70FB and may be downloaded from the sudo.ws web site or the OpenPGP Key Server.

Source Distribution

Mon, 01 Jan 0001 00:00:00 +0000

Source distributions are signed with Todd’s PGP key. Two keys are included in the file, the current pgp signing key with the fingerprint 59D1 E9CC BA2B 3767 04FD D35B A9F4 C021 CEA4 70FB and the old pgp signing key with the fingerprint CCB2 4BE9 E948 1B15 D341 5953 5A89 DFA2 7EE4 70C4. The signing keys are also available from the MIT public key server and the OpenPGP public key server.

Development Release

Mon, 01 Jan 0001 00:00:00 +0000

The current development release of sudo is 1.9.18rc1.

Binary packages are also available for development releases.

For full details see the ChangeLog file or view the commit history via git or GitHub.

If you plan to use a development release of sudo, please subscribe to the sudo-workers mailing list so that you will receive updates on bug fixes and related announcements.

You may also be interested in the sudo-commits mailing list which receives a message for each commit to the sudo source tree.

Prebuilt Packages

Mon, 01 Jan 0001 00:00:00 +0000

Binary packages are signed with Todd’s PGP key. For .rpm and .deb packages, the signature is embedded in the package file itself. All other files use detached signatures (separate .sig files). Two keys are included in the file, the current pgp signing key with the fingerprint 59D1 E9CC BA2B 3767 04FD D35B A9F4 C021 CEA4 70FB and the old pgp signing key with the fingerprint CCB2 4BE9 E948 1B15 D341 5953 5A89 DFA2 7EE4 70C4. The signing keys are also available from the MIT public key server and the OpenPGP public key server.

Static Analysis

Mon, 01 Jan 0001 00:00:00 +0000

Static analysis security testing (SAST) is a way of finding flaws in software without running it in the traditional sense. Source code is checked for dangerous patterns and data flow analysis is performed to find potential errors. One of the advantages of SAST is that it is capable of finding errors in code paths that are unlikely, but still possible, to happen at run-time.

Multiple SAST tools are used during sudo development. Why use more that one? Different tools find different classes of issues.

Download Mirrors

Mon, 01 Jan 0001 00:00:00 +0000

HTTP Mirrors

URL	Location
https://www.sudo.ws/dist/	Boulder, Colorado, USA
http://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/sudo/	West Lafayette, Indiana, USA
http://mirrors.concertpass.com/sudo	Lansing, Michigan, USA
http://www.netgull.com/sudo	Dallas, Texas, USA
https://bigsearcher.com/mirrors/sudo/	San Francisco, California, USA
http://sudo.cybermirror.org/	Duesseldorf, Germany
https://linux.domainesia.com/applications/sudo/	Indonesia
https://mirror.nevacloud.com/applications/sudo/	Indonesia
http://core.ring.gr.jp/archives/misc/sudo/	Japan
http://www.ring.gr.jp/archives/misc/sudo/	Japan
http://ftp.twaren.net/Unix/Security/Sudo/	Taiwan

FTP Mirrors

URL	Location
ftp://ftp.sudo.ws/pub/sudo/	Boulder, Colorado, USA
ftp://ftp.in2p3.fr/pub/sudo/	France
ftp://ftp.informatik.uni-hamburg.de/pub/os/unix/utils/sudo/	Hamburg, Germany
ftp://ftp.st.ryukoku.ac.jp/pub/security/tool/sudo/	Japan
ftp://ftp.cin.nihon-u.ac.jp/pub/misc/sudo/	Japan
ftp://core.ring.gr.jp/pub/misc/sudo/	Japan
ftp://ftp.ring.gr.jp/pub/misc/sudo/	Japan
ftp://sunsite.icm.edu.pl/packages/sudo/	Poland

Fuzzing Sudo

Mon, 01 Jan 0001 00:00:00 +0000

Fuzz testing is an automated method of finding bugs (and potential security vulnerabilities) by passing random input to a program or function. It is often performed in conjunction with a tool that can detect incorrect or undefined behavior, such as out-of-bounds access (buffer overflow/underflow), use of uninitialized data, use of memory after it has been freed, and freeing the same memory more than once. For testing sudo, we use both Address Sanitizer (ASAN) and Undefined Behavior Sanitizer (UBSAN) to catch these kind of bugs. In addition to potential security bugs, ASAN also identifies memory leaks.

Sudo Installation Notes

Mon, 01 Jan 0001 00:00:00 +0000

Sudo uses a configure script to probe the capabilities and type of the system in question. Sudo’s configure script has a large number of options that control its behavior and enable or disable optional functionality. Be sure to read this document fully before configuring and building sudo. You may also wish to read the file INSTALL.configure which explains more about the configure script itself.

System requirements

To build sudo from the source distribution you will need a POSIX-compliant operating system (any modern version of BSD, Linux, or Unix should work), a C compiler that conforms to ISO C99 or higher, and the ar, make, and ranlib utilities.

Sudo Upgrade Notes

Mon, 01 Jan 0001 00:00:00 +0000

Upgrading from a version prior to 1.9.15:

The sudoers plugin now uses a time stamp path name that is based on the user-ID instead of the user name. For example, a time stamp file that was /var/run/sudo/ts/root in sudo 1.9.14 will now be /var/run/sudo/ts/0. The lecture flag file name is now also based on the user-ID, which will result in users receiving the sudo lecture again on upgrade to sudo 1.9.15.

A Brief History of Sudo

Mon, 01 Jan 0001 00:00:00 +0000

The Early Years

Sudo was first conceived and implemented by Bob Coggeshall and Cliff Spencer around 1980 at the Department of Computer Science at SUNY/Buffalo. It ran on a VAX-11/750 running 4.1BSD. An updated version, credited to Phil Betchel, Cliff Spencer, Gretchen Phillips, John LoVerso, and Don Gworek, was posted to the net.sources Usenet newsgroup in December of 1985.

Contributing to Sudo

Mon, 01 Jan 0001 00:00:00 +0000

Thank you for your interest in contributing to Sudo! There are a number of way you can help make Sudo better.

Getting started

To get an overview of Sudo, see the README.md file. There are multiple ways to contribute, some of which don’t require writing a single line of code.

Filing bug reports/issues

If you believe you have found a bug, you can either file a bug report in the sudo bug database, https://bugzilla.sudo.ws/, or open a GitHub issue, whichever you find easier. If you would prefer to use email, messages may be sent to the sudo-workers@sudo.ws mailing list (public) or to sudo@sudo.ws (private).

Sanitizers and Sudo

Mon, 01 Jan 0001 00:00:00 +0000

Sudo’s build system has native support for compiling with Sanitizers when using the gcc or clang compilers. It is recommended that you use the configure options described below rather than trying to adjust the CC, CFLAGS or LDFLAGS Makefile options. Failure to do so may result in memory leak false positives.

Building sudo with sanitizer support

To build sudo with sanitizer support you must use the --enable-sanitizer configure option. This will add the -fsanitize and -fno-omit-frame-pointer compiler options in the correct places. It will also enable NO_LEAKS in config.h, which prevents some memory from being reported as leaked at exit time.

Troubleshooting FAQ

Mon, 01 Jan 0001 00:00:00 +0000

When I run configure, it says “C compiler cannot create executables”.

This usually means you either don’t have a working compiler. This could be due to the lack of a license or that some component of the compiler suite could not be found. Check config.log for clues as to why this is happening. On many systems, compiler components live in /usr/ccs/bin which may not be in your PATH environment variable.

Building Sudo Packages

Mon, 01 Jan 0001 00:00:00 +0000

Starting with version 1.7.4, sudo is distributed in binary package form in addition to the traditional source tarballs. In order to support as many operating system-dependent package formats as possible without having to maintain a large number of configuration files, sudo uses PolyPkg to build the actual packages.

Package configuration is located in the sudo.pp file that is included with the sudo source distribution. The included mkpkg script can be used to configure sudo using the same parameters as the official binary packages and generate a package using the “package” target in the Makefile.

Contributors

Mon, 01 Jan 0001 00:00:00 +0000

The following list of people, sorted by last name, have contributed code or patches to this implementation of sudo since I began maintaining it in 1993. This list is known to be incomplete–if you believe you should be listed, send a note to sudo@sudo.ws.

Ackeret, Matt
Adler, Mark
Allbery, Russ
Anderson, Jamie
Andrew, Nick
Andric, Dimitry
Barron, Danny
Bates, Tom
Behan, Zdeněk
Bellis, Ray
Benali, Elias
Beverly, Jamie
Boardman, Spider
Bos, Sander
Bostley, P.J.
Bowes, Keith
Boyce, Keith Garry
Brantley, Michael
Braun, Rob
Březina, Pavel
Brooks, Piete
Brown, Jerry
Burr, Michael E
Burton, Ross
Bussjaeger, Andreas
Calvin, Gary
Campbell, Aaron
Chazelas, Stephane
Cheloha, Scott
Čížek, Vítězslav
Coleman, Chris
Corzine, Deven T.
Cusack, Frank
Dai, Wei
Dill, David
Earickson, Jeff
Eckhardt, Drew
Edgington, Ben
Esipovich, Marc
Espie, Marc
Faigon, Ariel
Farrell, Brian
Fobes, Steve
Frysinger, Mike
G., Daniel Richard
Gailly, Jean-loup
Gelman, Stephen
Gerraty, Simon J.
Graber, Stephane
Guillory, B.
Hayman, Randy M.
Henke, Joachim
Hideaki, Yoshifuji
Hieb, Dave
Holloway, Nick
Hoover, Adam
Hunter, Michael T.
Hutchings, Ben
Irrgang, Eric
Jackson, Brian
Jackson, John R.
Jackson, Richard L., Jr.
Janssen, Mark
Jindrák, Jaroslav
Jepeway, Chris
Jorge, Joel Peláe
Jover, Guillem
Juhani, Timo
Kikuchi, Ayamura
Kadow, Kevin
Kasal, Stepan
Kienenberger, Mike
King, Dale
King, Michael
Klyachkin, Andrey
Knoble, Jim
Knox, Tim
Komarnitsky, Alek O.
Kondrashov, Nikolai
Kopeček, Daniel
Kranenburg, Paul
Krause, David
Lakin, Eric
Larsen, Case
Levin, Dmitry V.
Libby, Kendall
Lobbes, Phillip E.
McIntyre, Jason
MacKenzie, David J.
McLaughlin, Tom
Makey, Jeff
Mallayya, Sangamesh
Manner, Róbert
Marchionna, Michael D.
Markham, Paul
Martinian, Emin
Meskes, Michael
Michael, David
Miller, Todd C.
Minier, Loïc
Moffat, Darren
Moldung, Jan Thomas
Morris, Charles
Mueller, Andreas
Müller, Dworkin
Nieusma, Jeff
Nikitser, Peter A.
Nussel, Ludwig
Orbán, László
Ouellet, Jean-Philippe
Paquet, Eric
Paradis, Chantal
Pasteleurs, Frederic
Percival, Ted
Perera, Andres
Peron, Christian S.J.
Peschel, Aaron
Peslyak, Alexander
Peterson, Toby
Pettenò, Diego Elio
Pickett, Joel
Plotnick, Alex
de Raadt, Theo
Rasch, Gudleik
Reid, Steve
Richards, Matt
Rossum, Guido van
Rouillard, John P.
Rowe, William A., Jr.
Roy, Alain
Ruusamäe, Elan
Ryabinkin, Eygene
Sato, Yuichi
Sánchez, Wilfredo
Sanders, Miguel
Sasaki, Kan
Saucier, Jean-Francois
Schoenfeld, Patrick
Schuring, Arno
Schwarze, Ingo
Scott, Dougal
Shand, Will
Sieger, Nick
Simon, Thor Lancelot
Skoll, Dianne
Slemko, Marc
Smith, Andy
Sobrado, Igor
Soulen, Steven
Spangler, Aaron
Spradling, Cloyce D.
Spradling, Michael
Stier, Matthew
Stoeckmann, Tobias
Street, Russell
Stritzky, Tilo
Stroucken, Michael
Tarrall, Robert
Thomas, Matthew
Todd, Giles
Toft, Martin
Torek, Chris
Tucker, Darren
Uhl, Robert
Uzel, Petr
Valery, Reznic
Van Dinter, Theo
Venckus, Martynas
de Vries, Maarten
Wagner, Klaus
Walsh, Dan
Warburton, John
Webb, Kirk
Wetzel, Timm
Wieringen, Marco van
Wilk, Jakub
Winiger, Gary
Wood, David
Zacarias, Gustavo
Zolnowsky, John

The following people have worked to translate sudo into other languages as part of the Translation Project, see https://translationproject.org for more details.

Mirroring Sudo

Mon, 01 Jan 0001 00:00:00 +0000

If you wish to mirror the sudo distribution, please mirror the master site, ftp://ftp.sudo.ws/pub/sudo. The best times to mirror are between midnight and 8am US mountain standard time (MST).

In addition to standard ftp-based mirroring, you may also mirror the ftp site via rsync. To mirror the ftp site via rsync, run something like

rsync -avz rsync.sudo.ws::sudo_ftp /path/to/your/mirror

If you wish to mirror the sudo web pages, you may do so via a web mirroring program such as wget. Alternately, you may use rsync to do the mirroring.

Translations

Mon, 01 Jan 0001 00:00:00 +0000

National Language Support, or NLS, means that a program’s informational, warning and error strings are stored in a message catalog which can be translated into the native language of the program’s users. Beginning with version 1.8.2, sudo supports NLS using the gettext family of functions.

NLS Translations for sudo are coordinated through the Translation Project.

If you would like to contribute a translation for sudo, please join a translation team at the Translation Project instead of contributing a .po file directly. This will avoid duplicated work if there is already a translation in progress. If you would like to become a member of a translation team, please follow the instructions for translators.

Sudo Alternatives

Mon, 01 Jan 0001 00:00:00 +0000

Of course, Sudo isn’t the only game in town. I won’t comment on these other options as I haven’t spent much time working with them (and I’d probably be a bit biased). If you would like to add to this list, please send mail to sudo@sudo.ws.

Open Source Sudo Alternatives

sudo-rs is a safety oriented and memory safe implementation of sudo and su written in Rust.

Sudo Plugins

Mon, 01 Jan 0001 00:00:00 +0000

Starting with version 1.8.0, sudo supports a modular framework that supports third-party policy and I/O logging plugins. In this framework, when a user runs sudo, the front-end queries a policy plugin to determine whether or not the command is to be allowed. If it is allowed, the policy plugin returns a description of how to run the command along with the argument vector and environment to pass to the execve() system call. While the command is being run, the I/O plugin, if any, is passed all input to and output from the command.

ChangeLog

Mon, 01 Jan 0001 00:00:00 +0000

2026-06-14 Todd C. Miller

logsrvd/logsrvd_relay.c:
Move tls_connect_error_fn() inside #ifdef HAVE_OPENSSL block

Fixes a compilation error when the –disable-openssl configure option is specified. Bug #1093. [f6a94ab6a]

2026-06-13 Todd C. Miller

plugins/sudoers/sudoers.c:
sudoedit: perform relative file name expansion before policy check

The expansion of non-fully qualified file names needs to happen before the command is matched against sudoers. [92a9b0637]

2026-06-12 Todd C. Miller

plugins/sudoers/sudoers.c:
sudoedit: prepend current working directory for relative file names

Sudo License

Mon, 01 Jan 0001 00:00:00 +0000

Sudo is distributed under the following license:: Copyright (c) 1994-1996, 1998-2026 Todd C. Miller <Todd.Miller@sudo.ws>; Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.; THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Sudo Logo

Mon, 01 Jan 0001 00:00:00 +0000

Sudo Sandwich Logo

Sudo Shield Logo

Export Controls

Mon, 01 Jan 0001 00:00:00 +0000

Use of encryption

Prior to version 1.9.0, Sudo did not include support for encrypting data and was not subject to any export controls. However, starting with version 1.9.0, Sudo supports encrypted connections between the sudo_logsrvd daemon and the sudoers plugin. Specifically, TLS 1.2 or higher is used which supports strong encryption. The actual encryption algorithms used depend on the Sudo configuration as well as the version of OpenSSL or LibreSSL sudo is linked with (sudo does not include an implementation of any encryption algorithms itself). Some users may need to know whether Sudo is covered under U.S. export restrictions, specifically the Export Administration Regulations (EAR) and if so, what its Export Control Classification Number (ECCN) might be.

Local Privilege Escalation via chroot option

Mon, 30 Jun 2025 14:00:00 +0000

An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

Sudo versions affected:

Sudo versions 1.9.14 to 1.9.17 inclusive are affected.

CVE ID:

This vulnerability has been assigned CVE-2025-32463 in the Common Vulnerabilities and Exposures database.

Local Privilege Escalation via host option

Mon, 30 Jun 2025 14:00:00 +0000

Sudo’s host (-h or --host) option is intended to be used in conjunction with the list option (-l or --list) to list a user’s sudo privileges on a host other than the current one. However, due to a bug it was not restricted to listing privileges and could be used when running a command via sudo or editing a file with sudoedit. Depending on the rules present in the sudoers file this could allow a local privilege escalation attack.

Why sudo 1.9.16 enables secure_path by default?

Mon, 16 Sep 2024 08:00:00 +0200

Sudo 1.9.16 is now out, containing mostly bug fixes. However, there are also some new features, like the json_compact option I wrote about a while ago. The other major change is, secure_path is now enabled by default in the sudoers file, and there is a new option to fine-tune its content.

Before you begin

As usual, operating systems usually lag behind with sudo versions. If your OS does not have yet 1.9.16 or later, there is a good chance that you can find a ready to use installer on the sudo website at https://www.sudo.ws/getting/download/#binary.

When it comes to sudo logging, pretty is not always better

Thu, 11 Apr 2024 08:00:00 +0200

Version 1.9.16 of sudo will introduce a new logging option: json_compact. This does not affect logging to syslog, only logging to files. Previously, sudo created human-readable JSON log files. With this new setting enabled, logs are no longer pretty but can be easily read by logging software.

Before you begin

As I am writing this blog, version 1.9.16 is not yet released, not even a beta. For now, if you want to test this feature, you will have to compile sudo yourself from source. Once 1.9.16 is released, it will be available here on the sudo website as ready to install package for major Linux and UNIX variants. And eventually it will officially become available in various operating systems.

More info with -ll in sudo 1.9.15

Wed, 08 Nov 2023 08:00:00 +0200

Version 1.9.15 of sudo gives more detailed information when using the -ll option. For commands, it adds the rule that allows it. Without a command parameter, it lists rules affecting a given user. It also prints which file contains the given rule, making debugging easier.

Before you begin

Unless you are using a rolling Linux distribution, there is a good chance that sudo 1.9.15 is not yet available for your system. Luckily the sudo project provides you with easy to use binary packages for many popular Linux distributions and UNIX variants. Check https://www.sudo.ws/getting/packages/ to see if your system is supported. If not, you can still build sudo from source.

Double free with per-command chroot sudoers rules

Mon, 27 Feb 2023 08:00:00 -0700

A flaw exists in sudo’s per-command chroot feature that could result in the variable that stores the command being freed more than once.

Sudo versions affected:

Sudo versions 1.9.8 through 1.9.13p1 inclusive are affected. Versions of sudo prior to 1.9.8 are not affected.

CVE ID:

This vulnerability has been assigned CVE-2023-27320 in the Common Vulnerabilities and Exposures database.

The list pseudo-command

Tue, 21 Feb 2023 08:00:00 +0200

Version 1.9.13 of sudo adds the list pseudo-command. Previously, only root or a user with the ability to run any command as either root or the target user could list privileges. Using the list pseudo-command it is possible to list the privileges of another user without any additional privileges, thus tightening security even more.

Before you begin

Unless you are using a rolling Linux distribution, there is a good chance that sudo 1.9.13 is not yet available for your system. Luckily the sudo project provides you with easy to use binary packages for many popular Linux distributions and UNIX variants. Check https://www.sudo.ws/getting/packages/ to see if your system is supported. If not, you can still build sudo from source.

Sudoedit can edit arbitrary files

Wed, 18 Jan 2023 08:00:00 -0700

A flaw in exists in sudo’s -e option (aka sudoedit) that allows a malicious user with sudoedit privileges to edit arbitrary files.

Sudo versions affected:

Sudo versions 1.8.0 through 1.9.12p1 inclusive are affected. Versions of sudo prior to 1.8.0 construct the argument vector differently and are not affected.

CVE ID:

This vulnerability has been assigned CVE-2023-22809 in the Common Vulnerabilities and Exposures database.

Running sudo without updating cached credentials

Tue, 25 Oct 2022 08:00:00 +0200

One of the recurring questions at conferences was whether there is a way to check cached sudo credentials without updating them. Version 1.9.12 of sudo introduces the -N option which makes this possible, and also allows running any commands without updating the cached credentials.

Before you begin

The -N option was introduced in sudo version 1.9.12. There is a good chance that your choice of operating system still has an older version of sudo. You can easily compile sudo from source, however, using pre-built binary packages is even easier. Luckily the sudo website has a large collection of easy to use binary packages for many popular operating systems.

Central configuration and session analytics for sudo

Tue, 27 Sep 2022 08:00:00 +0200

Sudo is one of the most used command line tools in the Linux / UNIX / macOS world. It gives users the ability to execute commands as another user. Most often it is used to gain root (administrator) privileges. Sudo was created when there were a small number of independent large systems. Some support for multiple hosts, central management and monitoring were later added to it. These tools do their jobs, however large enterprises require ease of use, reporting and monitoring.

Sudo 1.9.11: sub-command detection improved on Linux

Tue, 28 Jun 2022 08:00:00 +0200

Version 1.9.8 of sudo introduced support for logging and intercepting sub-commands. These features quickly became very popular. The original implementation is portable, however it also has a number of limitations. Version 1.9.11 of sudo introduced an alternative, Linux-specific, implementation that allows sudo to detect sub-commands in even more situations.

Before you begin

Version 1.9.11 of sudo was released very recently. There is a good chance that your OS of choice still has an earlier version. If you use one of the more popular Linux distributions, ready-to-install sudo packages are available on the sudo website at https://www.sudo.ws/getting/packages/.

Looking inside sudo shell sessions: auditd, session recordings, log_subcmds

Tue, 31 May 2022 08:00:00 +0200

There are situations where you cannot avoid giving a user full shell access through sudo. A shell with administrative privileges gives complete control over your hosts. Until recently, sudo could only log the start of the shell, not the commands executed within it. You could record sessions with sudo, but watching recordings is boring, time consuming and can still be subverted. Version 1.9.8 introduced logging of sub-commands, but that is not yet available on many systems. An alternate approach is to use auditd to log commands started from a root shell.

Sudo for blue teams: how to control and log better

Tue, 03 May 2022 08:00:00 +0200

Sudo had many features to help blue teams in their daily job even before 1.9 was released. Session recordings, plugins and others made sure that most administrative access could be controlled and problems easily detected. Version 1.9 introduced Python support, new APIs, centralized session recordings, however some blind spots still remained. Learn how some of the latest sudo features can help you to better control and log administrative access to your hosts. You will learn about JSON logging in sudo, chroot support, logging sub-commands, and how to work with these logs in syslog-ng.

Sudo 1.9.10: hiding passwords in session recordings

Tue, 29 Mar 2022 08:00:00 +0200

Session recording has been available in sudo for many years, however not many people are aware of it. Even less well-known is that you can save not just the terminal output, but also what the user types. That way you can analyze what the user is doing within a shell session. Recordings may also include user passwords, which is not always desirable. Version 1.9.10 of sudo allows you to hide passwords in session recordings if it recognizes a password entry.

Sudo 1.9.10: using regular expressions in the sudoers file

Wed, 09 Mar 2022 08:00:00 +0200

It has been possible to use wildcards in the sudoers file for many years. This can make configuration easier and more flexible, but it also introduces problems of its own. Regular expressions, introduced in in sudo 1.9.10, allow you to create more fine grained rules. From this blog you will learn about some of the problems when you use wildcards in your sudoers file, and how using regular expressions can resolve those problems.

cvtsudoers: merging multiple sudoers files into one

Tue, 08 Feb 2022 08:00:00 +0200

We learned in my previous sudo blog that cvtsudoers is not just for LDAP. Version 1.9.9 of sudo extends the querying possibilities of cvtsudoers further and adds a brand new feature: merging multiple sudoers files into one. Both are especially useful when you have complex configurations. Querying lets you to better understand what the various rules allow in your sudoers file. Merging helps you to combine multiple configurations into one, so you do not have to maintain a separate sudoers file on each of your hosts.

cvtsudoers: not just for LDAP

Thu, 13 Jan 2022 08:00:00 +0200

The main feature of cvtsudoers is that it can convert between the sudoers file format and LDAP’s LDIF file format. As I do not use LDAP in my lab environment I stopped caring about cvtsudoers after I read the first few lines of its man page. However, cvtsudoers has additional features useful even without LDAP: querying the sudoers file and printing permissions belonging to a given user or host.

Before you begin

I must admit, I have no idea which version of sudo introduced the filtering (-m) option to cvtsudoers. I only know that the current openSUSE Leap and AlmaLinux versions already support it, with versions 1.9.5 and 1.8.29 respectively. If the version of sudo supplied with your operating system is too old, you can find up-to-date sudo packages for many Linux distributions and UNIX variants at https://www.sudo.ws/getting/packages/.

Python support arrives in Safeguard for Sudo

Tue, 30 Nov 2021 08:00:00 +0200

Version 1.9 of sudo was released almost two years ago. One of the major new features was support for Python plugins. Previously, you could only extend sudo by coding in C to better suit your environment, which is not the easiest task to manage. Python makes both coding and distributing the results easier. Starting with Safeguard for Sudo 7.2, Python support is also available in an enterprise sudo management solution.

Sudo 1.9.8: intercepting commands

Wed, 06 Oct 2021 08:00:00 +0200

A month ago, when sudo 1.9.8 was still under development, we checked out the new log_subcmds option. It allows you log all commands (with some limitations) that are executed by a command started through sudo. For example, you can see if a shell was started through a text editor. The intercept option brings this one step further: you can prevent sub-commands from even running.

Before you begin

To use sudo’s intercept option you need sudo 1.9.8 (or later). At the time of writing it is not available in any of the major Linux distributions. You can download ready-to-use binary packages for some Linux distributions and UNIX variants from the sudo website or build sudo yourself from source. Various BSDs also have an up-to-date version of sudo in ports.

What is coming in sudo 1.9.8?

Tue, 31 Aug 2021 08:00:00 +0200

Sudo development is at version 1.9.8 beta 3. There are two major new features: sudo can intercept sub-commands and log sub-commands. In this quick teaser I introduce you to log_subcmds. I hope it is interesting enough for you to test it out and provide feedback.

So, what is log_subcmds good for? There are many UNIX tools that can spawn external applications. You only see vi in the logs, but can you be sure without session recording that your admin only edits what he is supposed to? With log_subcmds you can see all the commands started from an application run through sudo. Or you can see all the commands started from a shell, even without session recording.

Securing the sudo to sudo_logsrvd connection

Tue, 24 Aug 2021 08:00:00 +0200

Using sudo_logsrvd to centrally collect sudo session recordings from your network is a huge step forward in security: users cannot delete or modify session recordings locally. However, by default, transmission of recordings is not encrypted, making it open to modifications and eavesdropping. Encrypting the connection between sudo and sudo_logsrvd can eliminate these problems. Larger environments usually either have in-house PKI tooling in place, or colleagues who know all openssl options off the top of their heads. However, small and medium enterprises often lack the infrastructure or knowledge to work with TLS certificates.

New in 1.9.7: using sudo_logsrvd in relay mode

Tue, 15 Jun 2021 08:00:00 +0200

Relay mode was introduced to sudo_logsrvd in sudo version 1.9.7. But, first of all, what is sudo_logsrvd? It is the sudo recording service that allows you to collect sudo session recordings centrally. Using relay mode makes it possible to collect sudo session recordings even when the central service is inaccessible and provides you with a single exit point from your network.

In this blog you will learn why relay mode is important and how you can test it.

Analyzing your sudo session recordings with One Identity's SPS

Tue, 18 May 2021 08:00:00 +0200

Sudo is an open source application allowing you to execute commands as another user. Safeguard for Privileged Sessions (SPS) by One Identity is commercial software that allows you to control, monitor and record privileged access. Starting with the upcoming SPS version 6.10 you will be able to collect and analyze sudo session recordings in SPS.

Overview

Session (I/O log) recording has been present in sudo for quite some time, but recordings were only saved locally. Replaying a sudo session like a movie was useful even locally, but a malicious user with shell access could easily delete the recordings. Starting with sudo version 1.9, it is possible to collect sudo session recordings centrally, which makes deleting session recordings a lot more difficult.

Alerting to many different services using Python and sudo 1.9

Tue, 20 Apr 2021 08:00:00 +0200

Before version 1.9 was released, alterting in sudo was limited to e-mail messages. If you wanted to send alerts somewhere else, like Slack, you could only do this using external applications, like syslog-ng. Beginning with sudo 1.9, there is an Audit API that can be called from Python.

Previously, we provided you with a simple example that show how to print some debug information to the terminal. In this blog post we will extend that example with Apprise, a universal Python notification library. By integrating with Apprise, you can easily send alerts to dozens of different messaging services directly from sudo itself.

Fuzz testing sudo

Tue, 30 Mar 2021 08:00:00 +0100

Version 1.9.6 of sudo was released recently. This is primarily a bug fix release with almost no user visible changes. One of the changes visible to developers is that support for fuzz testing was added. What is fuzz testing? According to the Wikipedia: “Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks.”

Sudo on OpenBSD, DragonFlyBSD and NetBSD

Tue, 23 Feb 2021 08:00:00 +0100

My FOSDEM talk in the BSD devroom showcased what is new in sudo and syslog-ng and explained how to install or compile the software yourself on FreeBSD. I am a long-time FreeBSD user, started with version 1.0 in 1994. But soon after my talk I was asked what I know about the other BSDs. I knew that all BSDs have sudo in their ports system, but had no idea what shape those ports were in.

Sudo on FreeBSD

Tue, 26 Jan 2021 08:00:00 +0100

While FreeBSD does not install sudo as part of the base system, you can easily install it yourself. If you do not need anything more than basic functionality, you can install the binary package using the pkg command. Most users belong to this group. If you need advanced functionality, like Python support, you will have to compile sudo yourself from ports.

Are you surprised by the mention of basic and advanced functionality for sudo? If yes, read my article about what is new in sudo 1.9. Besides there are lots of lesser-known features in sudo 1.8 as well. You will learn that sudo is more than just a prefix for administrative commands.

Buffer overflow in command line unescaping

Tue, 26 Jan 2021 00:00:00 +0000

A serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug.

Sudo versions affected:

Sudo versions 1.7.7 through 1.7.10p9, 1.8.2 through 1.8.31p2, and 1.9.0 through 1.9.5p1 are affected.

Symbolic link attack in SELinux-enabled sudoedit

Mon, 11 Jan 2021 00:00:00 +0000

On systems where SELinux is enabled, sudo’s RBAC support allows a command to be run with a user-specified role and/or type. In order to transition to the target SELinux security context, sudo runs the command through the sesh helper program. When sudo is invoked as sudoedit, sesh is used to first create the editor temporary files with the proper security context and then, once the editor has run, to copy the edited temporary files to their original locations.

Sudo 1.9.4: new options for logging

Tue, 01 Dec 2020 08:00:00 +0100

While most of the changes in sudo version 1.9.4 are under the hood, there are some user-visible changes as well. Locating problems in the sudoers file became even easier as the column number is now also displayed when an error is found. There are also two logging related changes. Sudo_logsrvd, the service that collects session recordings centrally, can now also collect rejection log messages, not just information about successful sessions. It is now also possible to log events in JSON format.

Sudo 1.9.3: improved sudoers handling

Tue, 03 Nov 2020 08:00:00 +0100

Version 1.9.3 brought many improvements to how the sudoers file is handled. Zero-length files are not saved by sudoedit, in many cases error messages are more accurate, and sudo no longer refuses to run if there is a syntax error. Let’s take a more detailed look at these changes!

Before you begin

These new features were introduced in sudo version 1.9.3. There is a good chance that your operating system includes an older version of sudo. You can download ready-to-use binaries for many different operating systems directly from the sudo website or you can build sudo from source yourself.

Using chroot and cwd in sudo

Tue, 29 Sep 2020 08:00:00 +0200

Starting with sudo 1.9.3, you can change both the root and the working directories within sudo itself. Neither option is enabled by default–you need to explicitly enable them in the sudoers file. When enabled, you can fine-tune target directories or allow your users to specify the directory to use. The logs reflect when these settings have been used.

Before you begin

Aliases: making your sudoers file manageable

Tue, 08 Sep 2020 08:00:00 +0200

The default sudoers file gives one group of users full control over your machine:

%wheel ALL=(ALL) ALL

Once it is not just you and your best friend administering a machine, you will start to give more fine-grained privileges to administrators. All fields in the above configuration line can be replaced by a list of values. A list of user names, a list of host names, a list of commands, and so on. Soon you will copy and paste these lists around in your sudoers file. It looks simple and manageable at first, but soon the sudoers file no longer fits on your screen. This is the time (well, actually a lot earlier) when you should turn to aliases.

Sudo 1.9: using the new approval API from Python

Wed, 05 Aug 2020 09:00:00 -0600

Version 1.9 of sudo introduced the approval plugin API, making it possible to have extra restrictions before executing a command. These only run after the policy plugin has succeeded, so you can effectively add additional layers of policy without replacing the policy plugin and sudoers. Multiple approval plugins may be defined, and all must succeed in order for the command to be executed.

In this blog you will find a simple Python script utilizing the approval API. It implements a simple check: if the current time is within a certain range the command is allowed. This script is part of the sudo documentation under the name example_approval_plugin.py.

Sudo 1.9: using the new Audit API from Python

Tue, 23 Jun 2020 02:00:00 -0600

Version 1.9 of sudo introduced a new API to access audit information. This is not a user-visible feature. In other words, you cannot use it directly from the sudoers file. It is an API, meaning that you can access audit information from plugins, including ones written in Python. You can use it in many different ways, like sending events from sudo directly to Elasticsearch or LaaS when something interesting happens. You can also use it for debugging and print otherwise difficult to access information to the screen in whatever format you like. In this blog you will find a simple Python plugin which displays information on the terminal when a command is run. It is derived from a more complex example that is available as part of the sudo package called example_audit_plugin.py.

Sudo 1.9: using the group plugin from Python

Tue, 26 May 2020 10:00:00 -0600

Using the sudo group plugin, you can connect sudo to external systems and approve commands based on non-UNIX groups. For example, Authentication Services by One Identity uses this solution. Starting with version sudo 1.9, you can also write group plugins in Python. You can use this to check databases or APIs if the admin trying to run a command is a member of a group. This way you can check, for example, if an admin is on duty.

Sudo 1.9: accessing terminal data from Python

Tue, 21 Apr 2020 12:00:00 -0600

Sudo 1.9 is now feature complete. One of the new features is Python support, meaning that you can easily extend sudo functionality using Python scripts. It supports the very same APIs as the regular C plugin API, only the language is different. One of the more interesting APIs is the IO logging API, which provides access to terminal data in real-time, both input and output. This way you can check if a sudo user is accessing data that he should not, or analyze the commands entered and terminate a session before a disaster occurs. In this blog you will find two simple examples for the above use cases. Both are over simplified but functional. You can use them to test out the new functionality, or as a basis for your own code.

What's new in sudo 1.9: recording service

Wed, 18 Mar 2020 12:00:00 -0600

Version 1.9 of sudo is now feature complete: all major features are implemented. On the other hand, sudo 1.9 needs testing and a bit of polishing before it can be made generally available. This is where you can help. Testing is easy, as for most platforms the project provides ready-to-install packages. In this blog I will show you how to test the recording service.

For an overview of 1.9 features see What is coming up in sudo 1.9?
To get started with Python support in sudo, including compile instructions, see What’s new in sudo 1.9: Python

Testing the recording service

The recording service collects session recordings centrally, which offers many advantages compared to local storage:

Buffer overflow when pwfeedback is set in sudoers

Thu, 30 Jan 2020 00:00:00 +0000

Sudo’s pwfeedback option can be used to provide visual feedback when the user is inputting their password. For each key press, an asterisk is printed. This option was added in response to user confusion over how the standard Password: prompt disables the echoing of key presses. While pwfeedback is not enabled by default in the upstream version of sudo, some systems, such as Linux Mint and Elementary OS, do enable it in their default sudoers files.

What's new in sudo 1.9: Python

Tue, 28 Jan 2020 14:00:00 -0700

One of the most interesting new features of the upcoming sudo version 1.9 is Python support. While version 1.8 introduced plugin support, Python support means that you can extend sudo using the same APIs but write plugins in Python instead of C. Version 1.9 is still under development but you are encouraged to test it and provide feedback about your experiences. From this blog, you can learn how to install ready to use beta quality packages from the sudo website, how to compile it yourself (on CentOS) and how to test Python support using a very simple example script.

What is coming up in sudo 1.9?

Tue, 07 Jan 2020 14:00:00 -0700

I guess it is not an overstatement to say that many interesting new features are coming to sudo in version 1.9. On the other hand, most sudo users are still only aware of its basic functionality. In this blog I would like to draw your attention to my Opensource.com article, which describes some lesser known features of sudo. Finally, I will point you to four upcoming conference talks about different aspects of sudo.

Which sudo users to insult - sudo configuration basics

Tue, 19 Nov 2019 10:00:00 -0700

This blog helps you to get started with configuring sudo and learn how to avoid the most common mistakes. But the title “getting started with sudo” sounds a lot less interesting :-) Based on responses to my talks, one of the most popular configuration option of sudo is insults. You should not think about anything serious here: just some funny messages when a user mistypes a password. But as some users find these messages inappropriate, these are now disabled by default, but can be enabled. In this blog I’ll show you how to configure sudo’s insults and how to enable (or disable) them for a set of users.

After talk Q&A

Tue, 22 Oct 2019 08:08:32 -0600

After I finish a talk on sudo at a conference, I usually receive quite a few questions. Many of the answers I gave earlier were already included in the latest version of my sudo talk. The following is a collection of questions and answers from different conferences.

How can I change the insults (the funny messages displayed when someone enters the wrong password) of sudo?

Right now the insult messages are hard-coded. There are plans to use an external file for them, but obviously this change is not high on the TODO list.

Potential bypass of Runas user restrictions

Mon, 14 Oct 2019 00:00:00 +0000

When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.

This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.

Some sudo features: logs, digest check, session recording & more

Wed, 02 Oct 2019 12:30:00 -0600

If there is one utility installed on almost all Linux/UNIX systems, it is sudo. Still, most sudo users – including myself until a year ago – only know this app as the prefix for administrative commands and using the default configuration. By the end of this blog you will know that it is a lot more. After a brief introduction to sudo you can learn a number of lesser know sudo features: digest check, configuration in LDAP, session recording, extensive logging and even plugins The current blog just introduces you to these features, in later blogs you can learn about them in depth.

Sudo at All Things Open

Thu, 12 Sep 2019 08:08:32 -0600

Learn about What You Most Likely Did Not Know About Sudo… at this year’s All Things Open conference.

If you have not heard about it yet, All Things Open is one of the largest open source events on the US East Coast. This year the conference is October 13-15, in the area known as the Research Triangle. People from all aspects of open source participate: users, developers, decision makers and as the name of the area implies, many people from research.

The first sudo blog...

Tue, 16 Jul 2019 10:49:32 -0600

Let me tell you a personal story, how this blog was born.

First a bit of introduction. I am Peter Czanik, working for the past nine years as syslog-ng evangelist at Balabit. Obviously I also deal with the commercial variant, but my focus is Open Source. That is one of the reasons why I was very happy to learn that Todd Miller, developer of the sudo application, became my colleague when Balabit was acquired by One Identity last year.

Potential file overwrite or tty access on Linux

Tue, 30 May 2017 00:00:00 +0000

On Linux systems, sudo parses the /proc/[pid]/stat file to determine the device number of the process’s tty (field 7). The fields in the file are space-delimited, but it is possible for the command name (field 2) to include white space (including newline), which sudo does not account for. A user with sudo privileges can cause sudo to use a device number of the user’s choosing by creating a symbolic link from the sudo binary to a name that contains white space followed by a number.

Potential bypass of sudo_noexec.so on Linux

Wed, 26 Oct 2016 00:00:00 +0000

A flaw exists in sudo’s noexec functionality that may allow a user with sudo privileges to run additional commands even when the NOEXEC tag has been applied to a command that uses either the system() or popen() functions.

Sudo versions affected:

1.6.8 through 1.8.14p3 inclusive.

CVE ID:

This vulnerability has been assigned CVE-2016-7032 in the Common Vulnerabilities and Exposures database.

Potential bypass of sudo_noexec.so via wordexp()

Wed, 26 Oct 2016 00:00:00 +0000

Sudo versions affected:

1.6.8 through 1.8.18 inclusive.

CVE ID:

This vulnerability has been assigned CVE-2016-7076 in the Common Vulnerabilities and Exposures database.

Arbitrary file access via TZ environment variable

Mon, 09 Feb 2015 00:00:00 +0000

Prior to sudo 1.8.12, the TZ environment variable was passed through unchecked. Most libc tzset() implementations support passing an absolute pathname in the time zone to point to an arbitrary, user-controlled file. This may be used to exploit bugs in the C library’s TZ parser or open files the user would not otherwise have access to. Arbitrary file access via TZ could also be used in a denial of service attack by reading from a file or fifo that will block.

Security policy bypass when env_reset is disabled

Wed, 05 Mar 2014 00:00:00 +0000

If the env_reset option is disabled in the sudoers file, a malicious user with sudo permissions may be able to run arbitrary commands with elevated privileges by manipulating the environment of a command the user is legitimately allowed to run.

Sudo versions affected:

Sudo 1.6.9 through 1.8.4p5 inclusive. Sudo 1.8.5 and higher are not affected.

Authentication bypass when clock is reset

Wed, 27 Feb 2013 00:00:00 +0000

When a user successfully authenticates with sudo, a time stamp file is updated to allow that user to continue running sudo without requiring a password for a preset time period (five minutes by default). The user’s time stamp file can be reset using sudo -k or removed altogether via sudo -K.

A user who has sudo access and is able to control the local clock (common in desktop environments) can run a command via sudo without authenticating as long as they have previously authenticated themselves at least once by running sudo -k and then setting the clock to the epoch (1970-01-01 01:00:00).

Potential bypass of tty_tickets constraints

Wed, 27 Feb 2013 00:00:00 +0000

This time stamp file can either be common to all of a user’s terminals, or it can be specific to the particular terminal the user authenticated themselves on. The terminal-specific time stamp file behavior can be controlled using the tty_tickets option in the sudoers file. This option has been enabled by default since sudo 1.7.4. Prior to sudo 1.7.4, the default was to use a single time stamp for all the user’s sessions.

IP addresses in sudoers with netmask may match additional hosts

Wed, 16 May 2012 00:00:00 +0000

A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated netmask listed in the sudoers file or in LDAP. As a result, users authorized to run commands on certain IP networks may be able to run commands on hosts that belong to other networks not explicitly listed in sudoers.

Sudo format string vulnerability

Mon, 30 Jan 2012 00:00:00 +0000

A flaw exists in the debugging code in sudo versions 1.8.0 through 1.8.3p1 that can be used to crash sudo or potentially allow an unauthorized user to elevate privileges.

Sudo versions affected:

1.8.0 through 1.8.3p1 inclusive. Older versions of sudo are not affected.

CVE ID:

This vulnerability has been assigned CVE-2012-0809 in the Common Vulnerabilities and Exposures database.

Flaw in Runas Group password checking

Wed, 12 Jan 2011 00:00:00 +0000

Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo’s -g option (run as group), if allowed by the sudoers file. A flaw exists in sudo’s password checking logic that allows a user to run a command with only the group changed without being prompted for a password.

Sudo versions affected:

Sudo 1.7.0 through 1.7.4p4.

Flaw in Runas group matching

Tue, 07 Sep 2010 00:00:00 +0000

Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo -g option (run as group). A flaw exists in the logic that matches Runas groups in the sudoers file when the -u option is also specified (run as user). This flaw results in a positive match for the user specified via -u so long as the group specified via -g is allowed by the sudoers file.

Sudo's secure path option can be circumvented

Wed, 02 Jun 2010 00:00:00 +0000

Sudo “secure path” feature works by replacing the PATH environment variable with a value specified in the sudoers file, or at compile time if the –with-secure-path configure option is used. The flaw is that sudo only replaces the first instance of PATH in the environment. If the program being run through sudo uses the last instance of PATH in the environment, an attacker may be able to avoid the “secure path” restrictions.

Additional privilege escalation bug with sudoedit

Fri, 09 Apr 2010 00:00:00 +0000

A flaw exists in sudo’s -e option (aka sudoedit) in sudo versions 1.6.8 through 1.7.2p5 that may give a user with permission to run sudoedit the ability to run arbitrary commands. This bug is related to, but distinct from, CVE-2010-0426.

Sudo versions affected:

1.6.8 through 1.7.2p5 inclusive.

CVE ID:

This vulnerability has been assigned CVE-2010-1163 in the Common Vulnerabilities and Exposures database.

Privilege escalation bug with sudoedit

Mon, 22 Feb 2010 00:00:00 +0000

A flaw exists in sudo’s -e option (aka sudoedit) in sudo versions 1.6.9 through 1.7.2p3 that may give a user with permission to run sudoedit the ability to run arbitrary commands.

Sudo versions affected:

1.6.9 through 1.7.2p3 inclusive.

CVE ID:

This vulnerability has been assigned CVE-2010-0426 in the Common Vulnerabilities and Exposures database.

Negation within a Cmnd_Alias not honored

Sun, 06 Dec 2009 00:00:00 +0000

A flaw exists in sudo versions 1.7.0 to 1.7.2p1 that caused the negation operator to have no effect when used in a Cmnd_Alias.

Sudo versions affected:

1.7.0 through 1.7.2p1 inclusive.

Details:

Sudo uses the Cmnd_Alias syntax for named groups of commands the sudoers file. The Cmnd_Alias is expanded when command matching is performed as sudo checks whether a user is allowed to run a particular command. There is a flaw in the code that matches lists of commands where the negation operator was applied twice. This can result in a command being allowed that was intended to be explicitly disallowed. For example, give the following sudoers file fragment:

Bug in supplemental group matching

Thu, 29 Jan 2009 00:00:00 +0000

A bug was introduced in Sudo’s group matching code in version 1.6.9 when support for matching based on the supplemental group vector was added. This bug may allow certain users listed in the sudoers file to run a command as a different user than their access rule specifies.

Sudo versions affected:

Sudo versions 1.6.9 up to and including 1.6.9p19. Sudo version 1.7.0 is not affected.

Flaw in Kerberos 5

Tue, 17 Jul 2007 00:00:00 +0000

Sudo can optionally be built with support for Kerberos 5 authentication. A flaw in exists in sudo’s Kerberos 5 authentication that, depending on the local machine’s Kerberos 5 configuration, could allow a malicious user to avoid authenticating with sudo. The user would still be limited by the sudoers file as to what commands could be run (and as what user).

Sudo versions affected:

All versions prior to 1.6.9.

Perl scripts run via Sudo can be subverted

Tue, 08 Nov 2005 00:00:00 +0000

A flaw in exists in sudo’s environment sanitizing prior to sudo version 1.6.8p12 that could allow a malicious user with permission to run a perl script to execute arbitrary perl code.

Sudo versions affected:

All versions prior to 1.6.8p12.

CVE ID:

This vulnerability has been assigned CVE-2004-1051 in the Common Vulnerabilities and Exposures database.

Bash scripts run via Sudo can be subverted

Thu, 27 Oct 2005 00:00:00 +0000

A flaw in exists in sudo’s environment sanitizing prior to sudo version 1.6.8p10 that could allow a malicious user with permission to run a shell script that utilized the bash shell to run arbitrary commands. The /bin/sh shell on most (if not all) Linux and Mac OS X systems is bash.

Sudo versions affected:

All versions prior to 1.6.8p10.

Race condition in Sudo's pathname validation

Mon, 20 Jun 2005 00:00:00 +0000

A race condition in Sudo’s command pathname handling prior to Sudo version 1.6.8p9 that could allow a user with Sudo privileges to run arbitrary commands.

Sudo versions affected:

Sudo versions 1.3.1 up to and including 1.6.8p8.

CVE ID:

This vulnerability has been assigned CVE-2005-1993 in the Common Vulnerabilities and Exposures database.

Bash scripts run via Sudo can be subverted

Thu, 11 Nov 2004 00:00:00 +0000

A flaw in exists in sudo’s environment sanitizing prior to sudo version 1.6.8p2 that could allow a malicious user with permission to run a shell script that utilized the bash shell to run arbitrary commands. The /bin/sh shell on most (if not all) Linux systems is bash.

Sudo versions affected:

All versions prior to 1.6.8p2.

Sudoedit can expose file contents

Wed, 15 Sep 2004 00:00:00 +0000

A flaw in exists in sudo’s -e option (aka sudoedit) in sudo version 1.6.8 that can give an attacker read permission to a file that would otherwise be unreadable.

Sudo versions affected:

1.6.8 only

Details:

While sudoedit runs the actual editor as the invoking user, the temporary file is then re-opened with root privileges. An attacker can run sudoedit, remove the editor temporary file, make a link to an unreadable file with the same name as the old temporary file and quit the editor. The file being edited via sudoedit will now contain a copy of the previously unreadable file.

Sudo Prompt Buffer Overflow

Thu, 25 Apr 2002 00:00:00 +0000

A buffer overflow exists in sudo versions 1.5.7 to 1.6.5p2 (inclusive). The problem affects expansion of the “%h” and “%u” escape sequences in the prompt. Due to a bug it is possible to craft a prompt such that more bytes are written than have been allocated. Exploiting heap corruption bugs like this requires fairly in-depth knowledge of a system’s malloc internals. The bug has been exploited on Linux and can allow an attacker to gain root privileges. No known exploits exist for other operating systems but this should not be considered a Linux-only problem.

Security Issue with Sudo and Postfix

Mon, 14 Jan 2002 00:00:00 +0000

A security issue has been found by Sebastian Krahmer of the SuSE Security Team in Sudo versions 1.6.0 - 1.6.3p7. When the Postfix sendmail replacement is installed on a machine an attacker may be able to gain root privileges by way of Sudo.

Sudo versions affected:

1.6.0 - 1.6.3p7 (inclusive)

Details:

Starting with version 1.6.0 Sudo sends mail to the administrator as root to prevent the invoking user from killing the mail process and thus avoiding logging (in previous versions of Sudo the mail was sent as the invoking user).

Sudo Heap Corruption Bug

Thu, 22 Feb 2001 00:00:00 +0000

A single-byte heap corruption bug exists in sudo versions 1.6.3p5 and below. Exploitation of the bug requires in-depth knowledge of the system malloc internals. The bug has been exploited on Linux and can allow an attacker to gain root privileges. No known exploits exist for other operating systems but this should not be considered a Linux-only problem.

Sudo versions affected:

1.3.0 - 1.6.3p5 (inclusive)

Mon, 01 Jan 0001 00:00:00 +0000

Third party binary packages ↕

Operating System	URL	Location
AIX	IBM AIX Toolbox	New York, USA
AIX	AIXTOOLS - Open Source Toolbox for AIX	Netherlands
HP-UX	Porting And Archive Centre for HP-UX	UK
Solaris	OpenCSW	Switzerland

Mon, 01 Jan 0001 00:00:00 +0000

AIX 7.1 ↕

Package file	sha256 digest
sudo.1.9.18.0.aix71.bff.gz	1818f5f02a267e30ccd09e903c8639a181a8881eddd004a0a404e41cd100cad9
sudo-1.9.18rc1-1.aix71.rpm	d6c52a132f09cd004806b8375731b8f6e3a16b2b01193cc9054ec7b88b52e3fc
sudo-logsrvd.1.9.18.0.aix71.bff.gz	8514a3ceab9a4469a0cee8ed3821eb86a91783654261e5005ab2e35c377fe2ec
sudo-logsrvd-1.9.18rc1-1.aix71.rpm	93f36b159177fb630c82bf7b5ed70185c35a206dcaa5ff155686bb9442c3f223

AIX 7.3 and above ↕

Package file	sha256 digest
sudo.1.9.18.0.aix73.bff.gz	bb2cd04a9ec4c3a497ebe19f6beb056ee2dc6367832eec57555665d1a6b5e086
sudo-1.9.18rc1-1.aix73.rpm	d537558cdf18fb44e131978a665040fa1d9702ec67ac1766beced35ea5219b93
sudo-logsrvd.1.9.18.0.aix73.bff.gz	865c561df1e3e9fddcec43d63d3be0793ea401b022f5661798c2fb9ad7d3f6e2
sudo-logsrvd-1.9.18rc1-1.aix73.rpm	18e2cea0549eb1708195de9de247b3593cc4fe25f16509c3d31ee1afa75517ee

Debian 11 (bullseye) ↕

Package file	sha256 digest
sudo_1.9.18rc1-1_deb11_amd64.deb	aa25307cb25d8105732bda7b8129a3f630663405ab5d11352d6c5b60cbb4a4b3
sudo-ldap_1.9.18rc1-1_deb11_amd64.deb	d2b6f94387f0e808f078f328cc725dc9e0a687fa2a349da3a34c5d9c646e0e7e
sudo-logsrvd_1.9.18rc1-1_deb11_amd64.deb	3ca7bd219b2ef6655649eba757ef47ade4b577d1855fa8181cb861e4c3fc832b
sudo-python_1.9.18rc1-1_deb11_amd64.deb	bb8eb2354fd10ba0ecfad3e8a4168fc0cf29df6a3802703e8497f857d79c86da
sudo_1.9.18rc1-1_deb11_arm64.deb	ea9a4e818a3d6da936d1ee793d43780f403910efe523c7dda37c3ddeec9df105
sudo-ldap_1.9.18rc1-1_deb11_arm64.deb	232558bda82b4b9504587609dd367dab854830ff77ceab976d6727e8c1296578
sudo-logsrvd_1.9.18rc1-1_deb11_arm64.deb	245bdb6d9a025b0db419ef690d515af923d0b52a64199b78065ad9ad27d7e186
sudo-python_1.9.18rc1-1_deb11_arm64.deb	a25bde096f418ca78328fc6573c8d06ccefa7556e251c2a766bd096816807f5f
sudo_1.9.18rc1-1_deb11_i386.deb	ae7c8b5734cba9f59b3bce85afc2634f89cab9c07cf9be8748f256c8e98472bc
sudo-ldap_1.9.18rc1-1_deb11_i386.deb	2f5cf22781af6f7c08c854e62336efaf2abe38b19ff51be643b72539bc60f95a
sudo-logsrvd_1.9.18rc1-1_deb11_i386.deb	746ffc813931d37d266361a263122fbb1c484736ba867f964771f5c8e0b1ef5e
sudo-python_1.9.18rc1-1_deb11_i386.deb	33aea5b2060c151388965521eb4b37067e9837480d7e1d7901d46708121154f7

Debian 12 (bookworm) ↕

Package file	sha256 digest
sudo_1.9.18rc1-1_deb12_amd64.deb	569869c9ac040bf4166bf7acc592b14cdd70b9e822ce1155479a0631004e9799
sudo-ldap_1.9.18rc1-1_deb12_amd64.deb	86fb008153b868a5440a585ad96d0c7f15e4636fb3fe287cb29c667d7fa10dbb
sudo-logsrvd_1.9.18rc1-1_deb12_amd64.deb	6b033acb9681c63bebfc2b9bfd8b156d5f57673ea864a99c4d419ea8189b1722
sudo-python_1.9.18rc1-1_deb12_amd64.deb	efc2adcc352815b9ccd0bd349ff316ed3c62482b238101a681c5948858309556
sudo_1.9.18rc1-1_deb12_arm64.deb	cfc88bf07d075fa25b3563868720093aeace70125a4cb4faaae322793b3494ed
sudo-ldap_1.9.18rc1-1_deb12_arm64.deb	34e3282f154fc2a8e33a88aa4ca9c0c27d2e4d2a1d942d4df618d66229dc0980
sudo-logsrvd_1.9.18rc1-1_deb12_arm64.deb	9bcf3b528b733d5d9f206cd9a2050c0c4f411246415aa0023fde158188535770
sudo-python_1.9.18rc1-1_deb12_arm64.deb	4a11c78647a1085c1d2d3e6922f9be8752ece6b7068261aa3295838c77cf5b9b
sudo_1.9.18rc1-1_deb12_i386.deb	a0fe3e63459a27481a0c6db4c6b2ba0ff17423b1e5c7b38535b826234ae437cc
sudo-ldap_1.9.18rc1-1_deb12_i386.deb	47b1d47220cd61ab2df9e8579d4b415352ebacb25ee7906f1f50a19b89119699
sudo-logsrvd_1.9.18rc1-1_deb12_i386.deb	806bfada4e655d1646a481e22ee921824702dbe91fff696c1f238ddb7b98f329
sudo-python_1.9.18rc1-1_deb12_i386.deb	587a1c362f2d3b396e78d5e275e38d07e39bf71fc7dceefb81db215d00a5656d

macOS 12.00 (Monterey) ↕

Package file	sha256 digest
sudo-1.9.18rc1.mac1200.pkg	50aeb8a4ce733d675c68a9b3a97e047abfb087ab2360b6c203a73aaf0d34d76e
sudo-logsrvd-1.9.18rc1.mac1200.pkg	020184ce624b2e5466df524698d098e89dc494a88dbd53f0f3b888b2c83a3ae3

macOS 13.00 (Ventura) ↕

Package file	sha256 digest
sudo-1.9.18rc1.mac1300.pkg	5e64cc95f1d1f3386069babd389a5d44009d35a2524bfcf058fcb8b7b9fb9949
sudo-logsrvd-1.9.18rc1.mac1300.pkg	058b567f048e94f0a471664896a9c1fbd8a0f6ec8eed823df63f9ab06781bb4e

macOS 14.00 (Sonoma) ↕

Package file	sha256 digest
sudo-1.9.18rc1.mac1400.pkg	09fcc873398647703caf3e4b4ced9c705ac290f56dca7b89f0003cfea5500093
sudo-logsrvd-1.9.18rc1.mac1400.pkg	04fb50ad5856db39d6a7bfe7639b2f1a06d4f8cfb77b0b41ec54a2445e691e39

macOS 15.00 (Sequoia) ↕

Package file	sha256 digest
sudo-1.9.18rc1.mac1500.pkg	a156ae8461ae028fdfbba882ba97350fcc28fe75264060c1a514fc4fed60aa90
sudo-logsrvd-1.9.18rc1.mac1500.pkg	f24965848d7b1f69d08c1eba1318dc8d755a80fe88b4b3a363a4f7245e1d56a3

RHEL/Rocky/Oracle 8 ↕

Package file	sha256 digest
sudo-1.9.18rc1-1.el8.x86_64.rpm	97eae5aa67b19acefd7d3248133b1a48a2078208fdec9f3adc51c74f8c9d0529
sudo-logsrvd-1.9.18rc1-1.el8.x86_64.rpm	894e495cabf49ae2a43a8e9b459fb6613f5a8d1516f8d5cd8f60a988b10e72a1
sudo-python-1.9.18rc1-1.el8.x86_64.rpm	3787438afa0bcff35415e0739a49c47007188f0078e74f16cbc98e076066ceca
sudo-1.9.18rc1-1.el8.aarch64.rpm	eba1176e354a45e55fc8fe4225205bb2402c91221dd5a37d758e43dfc9a5b522
sudo-logsrvd-1.9.18rc1-1.el8.aarch64.rpm	168c424b81f68b97b2194313842652990633b374f43ff037d8cd1a87dd1d0bf9
sudo-python-1.9.18rc1-1.el8.aarch64.rpm	68533fe48b59161000dde4a0db57b51c517f84c527a39766a277a674428ea60a

RHEL/Rocky/Oracle 9 ↕

Package file	sha256 digest
sudo-1.9.18rc1-1.el9.x86_64.rpm	5bf3cf83d21e3a5e438532d01f733b338374647692d5c2937ba666037b33731a
sudo-logsrvd-1.9.18rc1-1.el9.x86_64.rpm	b90867d3b7e20f41b760d7630fa298627061ab056aa0c599e0fc090641453e98
sudo-python-1.9.18rc1-1.el9.x86_64.rpm	5fb89a92b26cd113e9e9997a4eebdf2a1f77db6b82ea76d15ee9426d2aa0178a
sudo-1.9.18rc1-1.el9.aarch64.rpm	442fae889d97a95705701a4338b79a881837a151c25fd486cd79f832b00cbf16
sudo-logsrvd-1.9.18rc1-1.el9.aarch64.rpm	6bc2e58ec9106220c79a9bd7208d27b8bd7784fb13c2934b700c098aea7b697f
sudo-python-1.9.18rc1-1.el9.aarch64.rpm	1a29678a6677cbd6fd535a0b878fc3f57e06ac3661b2b7d470af9b6affd48a37

RHEL/Rocky/Oracle 10 ↕

Package file	sha256 digest
sudo-1.9.18rc1-1.el10.x86_64.rpm	3e812825e1d0c13eb719711a5fc5856e0045dfce00638fbb58ea6a93e465dea8
sudo-logsrvd-1.9.18rc1-1.el10.x86_64.rpm	7fd3456b587e539b7ac1a52b510ad80a2ea1851d199deac5bfd66e2faf2cde6b
sudo-python-1.9.18rc1-1.el10.x86_64.rpm	0fe95bfeadfd38e5c94ea12563ebcd47455fcb7cd3e7ecacff335098bf478c9d
sudo-1.9.18rc1-1.el10.aarch64.rpm	d5d239c9ced265d443063f7fea0c718c5c5a28b99c414bd07e651f622119c67a
sudo-logsrvd-1.9.18rc1-1.el10.aarch64.rpm	1425a854bba469b6fccb17b333af51dcb4756f8346119f19ff047d4f46ea5c64
sudo-python-1.9.18rc1-1.el10.aarch64.rpm	4c8c4cea6ddf84454de518fadf8359284b9e65561c4b9e3ce585e01f79b00e7c

SuSE Linux Enterprise 12 ↕

Package file	sha256 digest
sudo-1.9.18rc1-1.sles12.x86_64.rpm	5d585da996fb0f2f7fd16a4faf92df1c05e319e042eb3156e1fb6d5867b33498
sudo-logsrvd-1.9.18rc1-1.sles12.x86_64.rpm	2109dee642819ae321c62ee18f4dd05f5bd79831693bcb3a5de8a6623d93ee42
sudo-python-1.9.18rc1-1.sles12.x86_64.rpm	edca54a4b826bcd722f9e5a738acd6dfbd83f3d0e3dbd480fdfcd45f11862f72
sudo-1.9.18rc1-1.sles12.aarch64.rpm	11c9d1d7d9543d2b1d61056661bb46b32b9b63177a87d0e8ca2a436486f370d4
sudo-logsrvd-1.9.18rc1-1.sles12.aarch64.rpm	538682c7aca48c1e8ae6ddd88090c4a587bc066f49bc29aeb441672210f802ae
sudo-python-1.9.18rc1-1.sles12.aarch64.rpm	4f9909b03ee0d562198d2c19deb583a53ccf2bc2d1d1617cdf3d8251ec59c000

SuSE Linux Enterprise 15 ↕

Package file	sha256 digest
sudo-1.9.18rc1-1.sles15.x86_64.rpm	ee01fb1af2653314b5dd9e97ba509e968473197bb56e16c9411e6aa39ab2dac6
sudo-logsrvd-1.9.18rc1-1.sles15.x86_64.rpm	d975fdd1ee371f802ac1c48e051b6e8e0d90d3577fd72b63a0ea26f169f52cdc
sudo-python-1.9.18rc1-1.sles15.x86_64.rpm	161fb04bb35c4b3409e583946c693a6c2a3cb92b84f37d8be143e3d024ff1518
sudo-1.9.18rc1-1.sles15.aarch64.rpm	3771f1eed4873ec230b56eb1360a30d4267d878207fbc41ef426b85248f48310
sudo-logsrvd-1.9.18rc1-1.sles15.aarch64.rpm	64a1460e476f0ba4f1e4889045ecc3a35c8e9468357a81ca2f580e2350619d60
sudo-python-1.9.18rc1-1.sles15.aarch64.rpm	f82282261178a1cf5bef1be68cb2b37f95c8ed2303561c9dfc2e8e1aff30aab8

Solaris 10 ↕

Package file	sha256 digest
TCMsudo-1.9.18rc1-sol10.i386.pkg.gz	30f50b1a2e1e250f0ba4aba4c3540319dc55ca8e31f46daf5eb2721a99721343
TCMsudo-ldap-1.9.18rc1-sol10.i386.pkg.gz	817344fd3f286196777af873db8ca35f10953e42183f7aadfca40c35ae76796d
TCMsudo-logsrvd-1.9.18rc1-sol10.i386.pkg.gz	e57c9791597bad160bf87890a8a5e15487d453db46ec94bbbee2628cccc5e20c
TCMsudo-1.9.18rc1-sol10.sparc.pkg.gz	cb88500614bf2dbe6660e8f32229a7bc491d9803bc15509af9617accd695b7a7
TCMsudo-ldap-1.9.18rc1-sol10.sparc.pkg.gz	eb249c9f74fefc56f1f05e251bdadb7a6611a9d62315af02918a9d1f3b98a66d
TCMsudo-logsrvd-1.9.18rc1-sol10.sparc.pkg.gz	30b8f2c3eca10eca20d690d11f2f88643558a9ac5f56c9fc5e40a97ed6b58df6

Solaris 11 ↕

Package file	sha256 digest
TCMsudo-1.9.18rc1-sol11.x86_64.pkg.gz	106e23a5ec40993260ec6a60d1b58a2ae5d5785a73bac2eb129a85429f775020
TCMsudo-ldap-1.9.18rc1-sol11.x86_64.pkg.gz	41794ae1832addb35c5f8b9f2be616935015deab5c6335b14a68bfc234b6ac25
TCMsudo-logsrvd-1.9.18rc1-sol11.x86_64.pkg.gz	f37cd7aa9e155d7e2cd350e712891236858a642e2466ab16692153f3d7abbefa
TCMsudo-1.9.18rc1-sol11.sparc64.pkg.gz	ea5b4669940c7a83ff53bdeb8944ea5a6d47f2278703dc47eb7938143638513c
TCMsudo-ldap-1.9.18rc1-sol11.sparc64.pkg.gz	f55f2dd4f39ec6942bf45a13e9906d7c0a17a23e54ea1c57e83bd2f980d148c3
TCMsudo-logsrvd-1.9.18rc1-sol11.sparc64.pkg.gz	6776ff813cbeccde3f0c4ac57164cf5e8d869bcf70131128df61dd731cf262d1

Ubuntu 20.04 ↕

Package file	sha256 digest
sudo_1.9.18rc1-1_ubu2004_amd64.deb	e7ae011d556bffdd662509fa9cd564b5a02b451e98d5827639de2025879cfaf9
sudo-ldap_1.9.18rc1-1_ubu2004_amd64.deb	a346d84378e20a980837a91fa87ea9db4007d43021491c93a96a05268f122a7f
sudo-logsrvd_1.9.18rc1-1_ubu2004_amd64.deb	f4a72711b997077a4cb48f4071bf30fbf4fdbd76d801cda454aa336b34ed6a83
sudo-python_1.9.18rc1-1_ubu2004_amd64.deb	ec16702bd01358a733314baa1cb9307dad42c21539f6d84f5c3c5368250b1fe6
sudo_1.9.18rc1-1_ubu2004_arm64.deb	d93c16ce1895123021f91e48f67fbe60546b960b9af38bdd449b57c59d0838b8
sudo-ldap_1.9.18rc1-1_ubu2004_arm64.deb	5e8e3dc980bb55ddceb63c8eb4a355edc1d286f8d2f076d749fcb39c10270ac6
sudo-logsrvd_1.9.18rc1-1_ubu2004_arm64.deb	a2f4b583751983cde697bd01832f3839ec25faf43ed2c299c8f175d771d6d9a8
sudo-python_1.9.18rc1-1_ubu2004_arm64.deb	ac69446c78ad49c04bcddac0efd9fca3b0c3d75320a5326779c63409041d7f0d

Ubuntu 22.04 ↕

Package file	sha256 digest
sudo_1.9.18rc1-1_ubu2204_amd64.deb	a50b208215d0063dbbf5816ea49b9810fb4fa9851377a32f867cd78cd5e41039
sudo-ldap_1.9.18rc1-1_ubu2204_amd64.deb	f626827e035303e561d3bc22eb38b9e4083f2e4be5427243a6cf4b001f869f82
sudo-logsrvd_1.9.18rc1-1_ubu2204_amd64.deb	b87e7201fe46a8e9b9637fc3d7c6cf5e0d4bc7a6a4c5b1dcf79777473341dd51
sudo-python_1.9.18rc1-1_ubu2204_amd64.deb	8f8efe6f4d956fea92da4fa696e5810629a1a39960d60e4ceba6a4f16e55fcb9
sudo_1.9.18rc1-1_ubu2204_arm64.deb	f796bb8b2f315be912f3c1f1bd0265491d187701bef2f746dfdc6a73d7c6e440
sudo-ldap_1.9.18rc1-1_ubu2204_arm64.deb	77103893f643a62238b7676618fb511f8535ca371f5a85a072c684d026857569
sudo-logsrvd_1.9.18rc1-1_ubu2204_arm64.deb	4c617448e3f608983a876c6602ee0ddb29fa9e2fb3779d53353df9db7599a708
sudo-python_1.9.18rc1-1_ubu2204_arm64.deb	910489ddedfc460c02dae097740fc01eefc3d5243c834390d6c5dd43a9a58b57

Ubuntu 24.04 ↕

Package file	sha256 digest
sudo_1.9.18rc1-1_ubu2404_amd64.deb	2686458302acbce4dea7498d8d89599b56a311f092020e56dfcbb783cf1160e1
sudo-ldap_1.9.18rc1-1_ubu2404_amd64.deb	400588e152c2c26b63058f677f47af62a7661f37c75025694980185fad3b4d14
sudo-logsrvd_1.9.18rc1-1_ubu2404_amd64.deb	d7ea5e563492adc4938ccf27beeea797aee3be4c6118818175fd9f934dac6f63
sudo-python_1.9.18rc1-1_ubu2404_amd64.deb	4e5a694d28353e4ddeea13086f2eb7e92f617457d577abe7ca30561f8cd40a44
sudo_1.9.18rc1-1_ubu2404_arm64.deb	d1debcf02f53289d7d11d29ec52a152e657eb09be7c84e55ff525fd1584518c7
sudo-ldap_1.9.18rc1-1_ubu2404_arm64.deb	526d20dba6cd2204b7e742cbffaccdae4cdd5ddbf622727b96b6f8c30135e074
sudo-logsrvd_1.9.18rc1-1_ubu2404_arm64.deb	aa00c82086392522d41c3cafd0dcb3837e8a307c0ec24165dbb14bafe6d87864
sudo-python_1.9.18rc1-1_ubu2404_arm64.deb	d71e74038c46d983a4f97dd2d63b6f693618dca5809068e471be51b819b06777

Mon, 01 Jan 0001 00:00:00 +0000

AIX 7.1 ↕

Package file	sha256 digest
sudo.1.9.17.2.aix71.bff.gz	d578cd155e24b403b6aeae9cc6cb4cbf201f5c694bf31bc7efb0b28a7e8ec14e
sudo-1.9.17-3.aix71.rpm	f2ef3b5e6c6ca251dd3de27aa8373d449a9b7acaf0dc6e78766187a5e8440e8b
sudo-logsrvd.1.9.17.2.aix71.bff.gz	b34585fab0688cc2a3865a8c3ca99f4730058d2a8fd4c4535b364b90be03723a
sudo-logsrvd-1.9.17-3.aix71.rpm	d0465de1b5e315139d7d98b32a7aff2cb43e42efccb1a7bf283d92e8b39088a1

AIX 7.3 and above ↕

Package file	sha256 digest
sudo.1.9.17.2.aix73.bff.gz	69263616d0cf3a7e6fb75441fdd9513d4763cc31b13c85f56cafbdfe752b0bf8
sudo-1.9.17-3.aix73.rpm	07b0560c7d909c36f848218650d7301615d80422954eb16a37727fec99848b35
sudo-logsrvd.1.9.17.2.aix73.bff.gz	96b539949338e05ca0a49ef0cb785ab4800ca473f97e5168db8dd9d992180c74
sudo-logsrvd-1.9.17-3.aix73.rpm	32b3166374c963f24f6685f423ca3a36164be39523ee9cae4e690cdb8dc0fc36

Debian 11 (bullseye) ↕

Package file	sha256 digest
sudo_1.9.17-3_deb11_amd64.deb	f003e4feff964db7620b41d51f791dcea0d5e3409ebae8c39da1316feea0059a
sudo-ldap_1.9.17-3_deb11_amd64.deb	3a168514ace267207edf402ba92f6d6e322aeb926bcd56ca0fc0b8edf82cc95c
sudo-logsrvd_1.9.17-3_deb11_amd64.deb	7cc0a3fc77304ccbda6f2483e866741f13812b18d339674aa15b6da074622598
sudo-python_1.9.17-3_deb11_amd64.deb	7121d905602ae67333c9cfee3a5263dd6f104aa26928c4a8034cd1b5a3b573cc
sudo_1.9.17-3_deb11_arm64.deb	d6b89961f76a9c1cb51c4505043b16bd91d2adceec21f15dc433ce48ea3489fa
sudo-ldap_1.9.17-3_deb11_arm64.deb	646d3333270d5f3f9687d759320f8dd03238bbde6cb186cff56b9fa9791b3909
sudo-logsrvd_1.9.17-3_deb11_arm64.deb	d97dc42b516a7127c5261bbe7b7dd02e52964cbb7fb27867f785c510230ad0cf
sudo-python_1.9.17-3_deb11_arm64.deb	785c39492d0f122a2b9d661611f1cdf73994009aef54b588dd2355602352c97f
sudo_1.9.17-3_deb11_i386.deb	2776900a1894e42c64b1625f6dbc21a6c964416b4425c16fa820c140b07260a7
sudo-ldap_1.9.17-3_deb11_i386.deb	a790500996d4eed9eff394407163f1460fac50b8d91a16ffebf0060976b4e0fe
sudo-logsrvd_1.9.17-3_deb11_i386.deb	9fab273109c2fdaf89109f6669253e9c03e2ad2e932e144e4f71537b41251194
sudo-python_1.9.17-3_deb11_i386.deb	e8a378b207b0f6fd164648f7ac0dc1e635c8399cc65628bd8babffa40fbc64f2

Debian 12 (bookworm) ↕

Package file	sha256 digest
sudo_1.9.17-3_deb12_amd64.deb	4ea5904fd43201b672d55a7cef5807220d73f433809e652fc2f82e56eeab51fe
sudo-ldap_1.9.17-3_deb12_amd64.deb	b2eb8a87530c3636a9d47580fd62513db5b753823120530403101c6ca9e22fc3
sudo-logsrvd_1.9.17-3_deb12_amd64.deb	fbad9ac7ccf253282297f0d516d9ff4c6ed52bddefc991e16fb049b98ad063ae
sudo-python_1.9.17-3_deb12_amd64.deb	4f3c257a09538cba92ac866764d97f9998c6cd70b8484db3b5dbf884d05cfc94
sudo_1.9.17-3_deb12_arm64.deb	e6f230558c85e89c4e70105edbc0b508510adf353b58dd79ce8d426d8e6d033d
sudo-ldap_1.9.17-3_deb12_arm64.deb	301968db7942e231161006975310abc98bdfdb48b6f04e0bf56e363c9d44ad90
sudo-logsrvd_1.9.17-3_deb12_arm64.deb	ec269c39b13261a23eed79202aa5eafa71cc6593b3d527f9c5d2526e5c194032
sudo-python_1.9.17-3_deb12_arm64.deb	72eaadd970dff1764120c62f8f8aced934b8704a9e6837da08e4a14a11fe7703
sudo_1.9.17-3_deb12_i386.deb	3ea0e73b8877efef5de7e927c0df646f648a3c47907204b9ec5d1b166300a988
sudo-ldap_1.9.17-3_deb12_i386.deb	47409fce8f479be7f6a3addf4aee255a6ea09fbd3cec033b8ce46313eda69c0c
sudo-logsrvd_1.9.17-3_deb12_i386.deb	ff9897760b04ea336d125ba215970a9d6f505739de4df280359947a7ddbb2d2d
sudo-python_1.9.17-3_deb12_i386.deb	14c47b7fbc7415e728c5bcfce5f1c65f2462176b2eb54bdacfffd260094b095e

macOS 12.00 (Monterey) ↕

Package file	sha256 digest
sudo-1.9.17p2.mac1200.pkg	4663bb841715f921eb103385c4c4c8e7bff6a9bbaf6ae59743aea3dababa14e5
sudo-logsrvd-1.9.17p2.mac1200.pkg	708f3e922eb7d47ff47444f132c51b65f338b493beb82572baa4252350e5c62e

macOS 13.00 (Ventura) ↕

Package file	sha256 digest
sudo-1.9.17p2.mac1300.pkg	e9f82c4e754066f8b7fb5dd5fc20a8143e69614970951d359ebea2c3fc85ab2a
sudo-logsrvd-1.9.17p2.mac1300.pkg	6a5fdb1b95239821b2e5f29e2cc79bee402375f976664d99ec8758d4f9e0e29a

macOS 14.00 (Sonoma) ↕

Package file	sha256 digest
sudo-1.9.17p2.mac1400.pkg	d6f30847b33f4c7ec1df98dfe28d42636a1169b1dde1885a4625f766702a1eaa
sudo-logsrvd-1.9.17p2.mac1400.pkg	e1838a969f0d4fd0bac9eef1f8e037e31a5f8d563802ddc91ff508dc941570a3

macOS 15.00 (Sequoia) ↕

Package file	sha256 digest
sudo-1.9.17p2.mac1500.pkg	83a2cdb1228a874edb4d309d87438ccf3c7be86baa8b34420106122932082474
sudo-logsrvd-1.9.17p2.mac1500.pkg	20ea2d997e50790d4ebb996ef4c3da28ae2857418661112761d8f2e88e1d7b70

RHEL/Rocky/Oracle 7 ↕

Package file	sha256 digest
sudo-1.9.17-3.el7.x86_64.rpm	1d11363567285321e271a142ad89a3d45224db3f3b9cd08fdaa25c360a672a11
sudo-logsrvd-1.9.17-3.el7.x86_64.rpm	8a910fd528ff8cb09f43ff44937fc3c4b212f6f2099d9582aa8a6e3de253067f
sudo-python-1.9.17-3.el7.x86_64.rpm	61d2089266c0cf59aa66975a173586b0f6c9cec9c0d33135d8d88600e65dfd3b
sudo-1.9.17-3.el7.aarch64.rpm	88f071b94ac03cfd8fc157bec9274caa74ed126a25ae3cba87b665afe600ed8a
sudo-logsrvd-1.9.17-3.el7.aarch64.rpm	2e412d839ac4b0cfbc225de9a0bc40b1e544c70e1c3fd1f81c994bcaa27cb7b2
sudo-python-1.9.17-3.el7.aarch64.rpm	d20a3a1acd8938708145bef23352bc9bd5eaa6cd01c8ed14a87f8f07174dfceb

RHEL/Rocky/Oracle 8 ↕

Package file	sha256 digest
sudo-1.9.17-3.el8.x86_64.rpm	077832d58d31dad78e85e19727ee73554c9d58b3becc9f0180ddd2f45b0db35a
sudo-logsrvd-1.9.17-3.el8.x86_64.rpm	ecfea2354d062b48f9117197d3ee87b364c3130aa903d847b49898d59135db11
sudo-python-1.9.17-3.el8.x86_64.rpm	2fa548d3d5535cd519a5c209aa886162485262c9facb01019d22e5404d3bfbd7
sudo-1.9.17-3.el8.aarch64.rpm	91a52e4192cca65611f2c8df53a6e5191404d35711e1a96e28101feab65072ed
sudo-logsrvd-1.9.17-3.el8.aarch64.rpm	f2149eb38ccc856ab6382d9f3536e51ef55f718f89b9367776b422edec645d58
sudo-python-1.9.17-3.el8.aarch64.rpm	9c72eba78d2a40bd2b022525286000e81edb3e628055c8f274e3aebef20433dd

RHEL/Rocky/Oracle 9 ↕

Package file	sha256 digest
sudo-1.9.17-3.el9.x86_64.rpm	ffbfe343beadeee8ab5b67a4b4fccc6e2ad52708b87b5d74b8d8d10a0cd62ba1
sudo-logsrvd-1.9.17-3.el9.x86_64.rpm	71eac4f29f3198a73204c377b57766d0ad5791efd794e4834deac80bca832b81
sudo-python-1.9.17-3.el9.x86_64.rpm	0a6b8961209fb40f14c0883de119274aa38afa20d0192d4c928212f47e82bb9b
sudo-1.9.17-3.el9.aarch64.rpm	a6e16af10f94ed140af387dc7da3048779ec25176cda5ca7d5778838d7e8f2e4
sudo-logsrvd-1.9.17-3.el9.aarch64.rpm	ae038fbdae2228b9be7dd69b2ba781217611d000dcf266859ca3a0b2875be082
sudo-python-1.9.17-3.el9.aarch64.rpm	4e1dfd5e6dd4637a59716311f2f87897f8ee52194301c60dff54b0a0742653a1

RHEL/Rocky/Oracle 10 ↕

Package file	sha256 digest
sudo-1.9.17-3.el10.x86_64.rpm	32638d834bf2aa5fdac9e56ade0ee3b601dfc18688988de64dfca9d7ecb95612
sudo-logsrvd-1.9.17-3.el10.x86_64.rpm	4607b71fdb0d379f7cfc70cabf8fc775cf5c160d44c8ba9b106e23c794d414a3
sudo-python-1.9.17-3.el10.x86_64.rpm	0064f982ce0a57e32ceb3dabfe0b2a5834bcfcf22754ad60609f5666d3b9a813
sudo-1.9.17-3.el10.aarch64.rpm	62889dc5e8bdf32dbec9d72711f4b348eb3b0651e0fd070c9109da5c23ed823f
sudo-logsrvd-1.9.17-3.el10.aarch64.rpm	8a7219c1fc165e72e8d9d90238275564146fb7b64a011dbdf80dd2c365cfba5d
sudo-python-1.9.17-3.el10.aarch64.rpm	5a05cc616cf7556a75d3936fcb39573adcdd10f8d7092a2ae8bf4ecff4a4f33a

SuSE Linux Enterprise 12 ↕

Package file	sha256 digest
sudo-1.9.17-3.sles12.x86_64.rpm	85e5cdb9427fbd6231d6d6bfe573854b5a26396f19fe30112966a9d61d44b131
sudo-logsrvd-1.9.17-3.sles12.x86_64.rpm	72106f9fc2647ea879019185190d600d6e1d6dbd4ba55b9de0da70ab1f4e0ada
sudo-python-1.9.17-3.sles12.x86_64.rpm	a206adadad135fa7fd8519604fa323c3c39b1620706d6fd1f5c28e3497364449
sudo-1.9.17-3.sles12.aarch64.rpm	f29b82f41c586e30cafdea3109cde1aeb7c072bc4071576aba1c688e80553449
sudo-logsrvd-1.9.17-3.sles12.aarch64.rpm	048deaf7cfbbf71dcf445af54eb271f6d36b6238d33113444d889ba6867d3b8f
sudo-python-1.9.17-3.sles12.aarch64.rpm	8b1b5fc354767f2ca080a6c7c3be7fa4c8d5af20a60ad1978061fe7de2c34657

SuSE Linux Enterprise 15 ↕

Package file	sha256 digest
sudo-1.9.17-3.sles15.x86_64.rpm	c574388d812bbbca30fdb593d488fbf1df60a1a4187140189cafbba7f331f67f
sudo-logsrvd-1.9.17-3.sles15.x86_64.rpm	ee1ccca8526b3a47dcb79967e4ce1f95878f677f0a27c444264be7e6c06cc908
sudo-python-1.9.17-3.sles15.x86_64.rpm	8d6a58557745967c1a9c2c0f0179dd6a4a2f9cd872b696f50be10d79078de08c
sudo-1.9.17-3.sles15.aarch64.rpm	bc823895ece7c8860f036d199a32b7b1e2364214a23a470297a35233093d6a41
sudo-logsrvd-1.9.17-3.sles15.aarch64.rpm	81345ac17183ce74142ac1a2eb8d386fc2187de20f7e0474b22abe30d10bc041
sudo-python-1.9.17-3.sles15.aarch64.rpm	a43ff582a842d48ed4dd59eb5879495451ab7dbea82b01e47ab6a568da50b41d

Solaris 10 ↕

Package file	sha256 digest
TCMsudo-1.9.17p2-sol10.i386.pkg.gz	11a1b104ee24d2385a827d7669daee76b1a76c54af05f92bae8a00a42e941f08
TCMsudo-ldap-1.9.17p2-sol10.i386.pkg.gz	3637296505647af4191b6aa055595f32299ae0be18a398e3becc35d063a76ce0
TCMsudo-logsrvd-1.9.17p2-sol10.i386.pkg.gz	8ccc72a34f9ad43d2f4db5020b350b8a1be5bb64b2eab1ac8786722569be7dc6
TCMsudo-1.9.17p2-sol10.sparc.pkg.gz	7899a632d634def6cdd79023c3bfd71cb3e1b75a1997bcdb79e57b565bb4cce5
TCMsudo-ldap-1.9.17p2-sol10.sparc.pkg.gz	311fe12cf80163760e75dbfbdb9a05c508f5c97273a6b27b0741226e7741829e
TCMsudo-logsrvd-1.9.17p2-sol10.sparc.pkg.gz	d3cf01c92b46292413093a138bede5889b58939783e6f75d61350806243075a1

Solaris 11 ↕

Package file	sha256 digest
TCMsudo-1.9.17p2-sol11.x86_64.pkg.gz	efa7fb976f4b632b9269e6a9a9fdb565840598b5a8388ebc230ac237527cc89e
TCMsudo-ldap-1.9.17p2-sol11.x86_64.pkg.gz	4fb32109658a6fdc62e94f891d477a45802c9f8ec273ff74423ea0bd0172548f
TCMsudo-logsrvd-1.9.17p2-sol11.x86_64.pkg.gz	78a607412de1d960b96811e2c42265c4ad5f189b57bfb90d59726b110ee0df22
TCMsudo-1.9.17p2-sol11.sparc64.pkg.gz	d779cb55b852afbf50443df4ab3e9b9d20579f3ccc7a1d8f7a47a5410eb0d960
TCMsudo-ldap-1.9.17p2-sol11.sparc64.pkg.gz	e47113e39eb5fd5a2146e407ca39fca88de44391d187889e87a2de282b921c6f
TCMsudo-logsrvd-1.9.17p2-sol11.sparc64.pkg.gz	1f9ee50b7c58c0af4f4e4637772d9eeff370ce0c81e11745d9b64da34760e902

Ubuntu 20.04 ↕

Package file	sha256 digest
sudo_1.9.17-3_ubu2004_amd64.deb	266d29533138953ae3d65b3b4844310926296389eb10a27786d3750fed4b63f4
sudo-ldap_1.9.17-3_ubu2004_amd64.deb	651c2f68e238442ee060132c6b0f06ee8eeb1ab4636b0aee03f7489c09b1da61
sudo-logsrvd_1.9.17-3_ubu2004_amd64.deb	43d372faf22ee1e098b9917a020a449e9d65bb16dc68d6008b3e13b14cc6a4ed
sudo-python_1.9.17-3_ubu2004_amd64.deb	6e41ad419d2c013c7cd50eb4177facb7d8d8c3ffc2ce56de684111b2615ca56d
sudo_1.9.17-3_ubu2004_arm64.deb	1e00eaeda88cb8c079b0163d97e4e5498c38b05cf29f5ec9b0514f126eef67dc
sudo-ldap_1.9.17-3_ubu2004_arm64.deb	28fbec3fb215a297b8ed11d5f6cb748cd5e4056274b041bdc8b470b5b511bd52
sudo-logsrvd_1.9.17-3_ubu2004_arm64.deb	b7bf65dc5b7148768962ff43f243883704f2a88c5ec5e88d330d15860d5b4105
sudo-python_1.9.17-3_ubu2004_arm64.deb	75ae5a5c6c1fe5457f707edb2ba2e4a403da5e1c471b0d8bacb3576bcd836c0c

Ubuntu 22.04 ↕

Package file	sha256 digest
sudo_1.9.17-3_ubu2204_amd64.deb	0b87791f5c318d637595c40ee28972f1f61d5b0159757949f9bf7fa4e6faadc4
sudo-ldap_1.9.17-3_ubu2204_amd64.deb	2737a2105115d67da741018e810a88c69fba4f617d01dd139393b19e976fd8da
sudo-logsrvd_1.9.17-3_ubu2204_amd64.deb	598110b025e1f714df9ea3061ea80136f5ac30d1619c091e9fff4e98eb0d571c
sudo-python_1.9.17-3_ubu2204_amd64.deb	873f0163cd042e3ef1145567a927696bfa1b4c591816eb0ab6506281f24a5ba3
sudo_1.9.17-3_ubu2204_arm64.deb	2742e6e9ff05ad606506fce404bcd984cc392651e6302715c4d175abcddd3620
sudo-ldap_1.9.17-3_ubu2204_arm64.deb	2d99f44836b300f80ce0a316c6b563a2c1604a2bcc36a7e1bad46718d00a3362
sudo-logsrvd_1.9.17-3_ubu2204_arm64.deb	6e14b3f81f13c19ff9e9aea940a2512f4dcdbb7efc937b8aeb6aed2bbe339f35
sudo-python_1.9.17-3_ubu2204_arm64.deb	da65bf7614aca9b55596b571c33ba06d8815569ddf585d5cc687806893fa24c0

Ubuntu 24.04 ↕

Package file	sha256 digest
sudo_1.9.17-3_ubu2404_amd64.deb	2893979967e044f9b47cf57961ee7557ccf7c9f086710d065f3a6b7135405740
sudo-ldap_1.9.17-3_ubu2404_amd64.deb	547c817d5e9708bea002a407ced3c855c56834f522de768bd4278c5810d6fd0d
sudo-logsrvd_1.9.17-3_ubu2404_amd64.deb	d3c007e11d0d001222f9b5f60f66fc76474c618188510d00c8ed28d2d2eeb4b1
sudo-python_1.9.17-3_ubu2404_amd64.deb	a5b8eb73992fca7c9e48eda903c2d9c0184a831babc0859aa4bd4821494f4692
sudo_1.9.17-3_ubu2404_arm64.deb	729fcee511d8f14155826bc4550b0002590109360dd705998eacad4441baf010
sudo-ldap_1.9.17-3_ubu2404_arm64.deb	95b034e3089438318ab74878f41c94b4c1f840197729e2412a9038c2043add11
sudo-logsrvd_1.9.17-3_ubu2404_arm64.deb	cb25a4714350d220fdaa9c1d59fd8c0756d709bf3489a4058a70941c4cf30888
sudo-python_1.9.17-3_ubu2404_arm64.deb	b6cc22544fefe69f72e5fa0ff59cfb811685211fa8b77f40d368948d86dfe28c

Mon, 01 Jan 0001 00:00:00 +0000

Sudo Version	URL	sha256 digest
1.9.17p2	sudo-1.9.17p2.tar.gz	4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb
1.9.17p1	sudo-1.9.17p1.tar.gz	ff607ea717072197738a78f778692cd6df9a7e3e404565f51de063ca27455d32
1.9.17	sudo-1.9.17.tar.gz	3f212c69d534d5822b492d099abb02a593f91ca99f5afde5cb9bd3e1dcdad069
1.9.16p2	sudo-1.9.16p2.tar.gz	976aa56d3e3b2a75593307864288addb748c9c136e25d95a9cc699aafa77239c
1.9.16p1	sudo-1.9.16p1.tar.gz	404994e23ae8bcf4be59ed6fd3759ad70a8cefa9bcf71640b33f176afec243b0
1.9.16	sudo-1.9.16.tar.gz	c0d84d797f06b732fc573d0b798ae83128c2bc33052057f05b560ec6bcbfa03d
1.9.15p5	sudo-1.9.15p5.tar.gz	558d10b9a1991fb3b9fa7fa7b07ec4405b7aefb5b3cb0b0871dbc81e3a88e558
1.9.15p4	sudo-1.9.15p4.tar.gz	2e20ec9865eeeea1316c6f49ec6ac4678869b689d4d90b44243bf4887d6dd532
1.9.15p3	sudo-1.9.15p3.tar.gz	78c87a1ccec42f7a095002fe2b1478a5106036359e362b867534a8e0056a0494
1.9.15p2	sudo-1.9.15p2.tar.gz	199c0cdbfa7efcfffa9c88684a8e2fb206a62b70a316507e4a91c89c873bbcc8
1.9.15p1	sudo-1.9.15p1.tar.gz	166c37ab93454a18186f922fe64ed5cd67ba6dddbcb0efba2df5898723dc9474
1.9.15	sudo-1.9.15.tar.gz	fd0e254870e92e873b508ba16382f5ac3af81a5a38d1ea9cf973606db4262589
1.9.14p3	sudo-1.9.14p3.tar.gz	a08318b1c4bc8582c004d4cd9ae2903abc549e7e46ba815e41fe81d1c0782b62
1.9.14p2	sudo-1.9.14p2.tar.gz	15f6308db0ed4265ec929f2c61e2e13492e551750c203ee001d1fcd8104c9514
1.9.14p1	sudo-1.9.14p1.tar.gz	e91bf5ef2e09d857ee901c3465cf7ddb37e43c763b65d19fa0862d1dec128faf
1.9.14	sudo-1.9.14.tar.gz	7bb70e4529ab2ada47ded970cdf2fe7be3084912861ddbac239eebdc92935a29
1.9.13p3	sudo-1.9.13p3.tar.gz	92334a12bb93e0c056b09f53e255ccb7d6f67c6350e2813cd9593ceeca78560b
1.9.13p2	sudo-1.9.13p2.tar.gz	df2004fde4c1033b1fdca339958e0ec633d393d604fcff9d1513abef1f94574d
1.9.13p1	sudo-1.9.13p1.tar.gz	672a3b83ace56b5fa12c7d89da771d75f5ae4472bec92791fbb98c2dd853bd43
1.9.13	sudo-1.9.13.tar.gz	3f55455b46edb0a129d925dcc39972f12f7c7fb78d0ccab6017ee16c8177e436
1.9.12p2	sudo-1.9.12p2.tar.gz	b9a0b1ae0f1ddd9be7f3eafe70be05ee81f572f6f536632c44cd4101bb2a8539
1.9.12p1	sudo-1.9.12p1.tar.gz	475a18a8eb3da8b2917ceab063a6baf51ea09128c3c47e3e0e33ab7497bab7d8
1.9.12	sudo-1.9.12.tar.gz	de15733888170c56834daafd34bf983db10fb21039742fcfc396bd32168d6362
1.9.11p3	sudo-1.9.11p3.tar.gz	4687e7d2f56721708f59cca2e1352c056cb23de526c22725615a42bb094f1f70
1.9.11p2	sudo-1.9.11p2.tar.gz	a21918eb9fc0063794f6887464fa2d924ab6d192e19063191a429605c22791d2
1.9.11p1	sudo-1.9.11p1.tar.gz	eb8b6c1a69a9adf4b82030b66d99d79214d7cba5031a0be43103a6176b16254b
1.9.11	sudo-1.9.11.tar.gz	b5476e30d83ca14734da9370f2206beb21c8a33fc85a504fb8a61d18d8b351be
1.9.10	sudo-1.9.10.tar.gz	44a1461098e7c7b8e6ac597499c24fb2e43748c0c139a8b4944e57d1349a64f4
1.9.9	sudo-1.9.9.tar.gz	6d6ee863a3bc26c87661093a74ec63e10fd031ceba714642d21636dfe25e3e00
1.9.8p2	sudo-1.9.8p2.tar.gz	9e3b8b8da7def43b6e60c257abe80467205670fd0f7c081de1423c414b680f2d
1.9.8p1	sudo-1.9.8p1.tar.gz	0939ee24df7095a92e0ca4aa3bd53b2a10965a7b921d51a26ab70cdd24388d69
1.9.8	sudo-1.9.8.tar.gz	f1735de999804ea1af068fba6a82cb6674ea64c789813b29266fd3b16cb294e6
1.9.7p2	sudo-1.9.7p2.tar.gz	28b5ee725dbf89a7852f42f309ca877d2810a9531b4eecfe59f3a84b6b4afca8
1.9.7p1	sudo-1.9.7p1.tar.gz	391431f454e55121b60c6ded0fcf30ddb80d623d7d16a6d1907cfa6a0b91d8cf
1.9.7	sudo-1.9.7.tar.gz	2bbe7c2d6699b84d950ef9a43f09d4d967b8bc244b73bc095c4202068ddbe549
1.9.6p1	sudo-1.9.6p1.tar.gz	a9e9cdc058fafeb9cd3ebfb864c81755e524d98aa022152763f25bce8ca3ca90
1.9.6	sudo-1.9.6.tar.gz	62c9580492cd2e7dd6273b5cfe197560f2c508a83649d1ce4f61c8ee02ff3a55
1.9.5p2	sudo-1.9.5p2.tar.gz	539e2ef43c8a55026697fb0474ab6a925a11206b5aa58710cb42a0e1c81f0978
1.9.5p1	sudo-1.9.5p1.tar.gz	4dddf37c22653defada299e5681e0daef54bb6f5fc950f63997bb8eb966b7882
1.9.5	sudo-1.9.5.tar.gz	3718b16de71fd6076858d5a1efe93a0d11d2f713fc51f24a314dfee78e4e83a5
1.9.4p2	sudo-1.9.4p2.tar.gz	c34af1fa79d40d0869e4010bdd64005290ea2e1ba35638ef07fcc684c4470f64
1.9.4p1	sudo-1.9.4p1.tar.gz	1172099dfcdd2fa497e13a3c274a9f5920abd36ae7d2f7aaacd6bc6bc92fd677
1.9.4	sudo-1.9.4.tar.gz	8b91bd2cc73af18a06a01406e38d154b837107be759f72e89cefeaa94e1103f0
1.9.3p1	sudo-1.9.3p1.tar.gz	dcb9de53e45e1c39042074b847f5e0d8ae1890725dd6a9d9101a81569e6eb49e
1.9.3	sudo-1.9.3.tar.gz	1d9889cc3b3b15ed8c2c7c3de3aa392a3a726838d020815067c080525c3f5837
1.9.2	sudo-1.9.2.tar.gz	7c98d201f181c47152711b9f391e0f6b5545f3ef8926298a3e8bc6288e118314
1.9.1	sudo-1.9.1.tar.gz	294116cefe10a02773917fc7440d8384b925955bc96a6e0eaa1977c83b34adff
1.9.0	sudo-1.9.0.tar.gz	ab231439c5dfdf4ecbef74f10d5f7e9686c2255c2f3887085b5c5e13281bf95c

Older versions ↕

Sudo Version	URL	sha256 digest
1.8.32	sudo-1.8.32.tar.gz	5ce3c18c5efbecd5437a0945f314f1822423eaf9a2d7eb7ecf80857bc32246c5
1.8.31p2	sudo-1.8.31p2.tar.gz	2a5d04b1b6db6a1926bc8d7082ed5f54aa9a330496589473a234844dcf2c2094
1.8.31p1	sudo-1.8.31p1.tar.gz	c73cfdfbc1c5cc259fcc3a355e1bacfed99c5580daeadec9704a24cd5e6d15d8
1.8.31	sudo-1.8.31.tar.gz	7ea8d97a3cee4c844e0887ea7a1bd80eb54cc98fd77966776cb1a80653ad454f
1.8.30	sudo-1.8.30.tar.gz	a35ad3ddc7465703e04190d3ff0b8d78ded9246749becf9a014dcb9c31c579e7
1.8.29	sudo-1.8.29.tar.gz	ce53ffac9604e23321334d8ba8ac59ded2bcf624fdb9dbde097ab2049bf29c7c
1.8.28p1	sudo-1.8.28p1.tar.gz	23ba5a84af31e3b5ded58d4be6d3f6939a495a55561fba92c6941b79a6e8b027
1.8.28	sudo-1.8.28.tar.gz	9129fa745a08caff0ce2042d2162b38eb9bf73bf43fcb248ac8b3a750c1f13a1
1.8.27	sudo-1.8.27.tar.gz	7beb68b94471ef56d8a1036dbcdc09a7b58a949a68ffce48b83f837dd33e2ec0
1.8.26	sudo-1.8.26.tar.gz	40da219a6f0341ccb22d04a98988e27f09b831d2561b14c6154067a49ef3fee2
1.8.25p1	sudo-1.8.25p1.tar.gz	9dc99c7a7d37a0ab938410995c133e15d6afb970c2c66f9264fe36d20c89195b
1.8.25	sudo-1.8.25.tar.gz	9dcf0f61f663b4051d4b37a57f2da9d2800182b8c19205edde616fc9d935dc41
1.8.24	sudo-1.8.24.tar.gz	b488557a198ecef30b7ad4011b59a66232dec2364ad956e11d8e17906c225be8
1.8.23	sudo-1.8.23.tar.gz	d863d29b6fc87bc784a3223350e2b28a2ff2c4738f0fb8f1c92bb38c3017e679
1.8.22	sudo-1.8.22.tar.gz	7256cb27c20883b14360eddbd17f98922073d104b214cf65aeacf1d9c9b9fd02
1.8.21p2	sudo-1.8.21p2.tar.gz	74c5746cd33a814e2431c39faf0d76f7f8a697379bd073862e3b156cf0d76368
1.8.21p1	sudo-1.8.21p1.tar.gz	ee50d3a249a96b1c5c8d3d21380eb96c63c6e61a888b13e3c2b941b23ab7c808
1.8.21	sudo-1.8.21.tar.gz	126e9214613e842e19a02658f060186fe6a5927948679d64895b17ed933bb523
1.8.20p2	sudo-1.8.20p2.tar.gz	bd42ae1059e935f795c69ea97b3de09fe9410a58a74b5d5e6836eb5067a445d9
1.8.20p1	sudo-1.8.20p1.tar.gz	9e980eb23a60dd11f0f452e672e705d7a386882bc230c6e8483050e03182db1d
1.8.20	sudo-1.8.20.tar.gz	9e97b8da859c6cc1b5b8c31db93002b750eae16af1bbda9140f8dd85b970e0e0
1.8.19p2	sudo-1.8.19p2.tar.gz	237e18e67c2ad59ecacfa4b7707198b09fcf84914621585a9bc670dcc31a52e0
1.8.19p1	sudo-1.8.19p1.tar.gz	b8afb1cf8736b6c61f171f2bf4b174818d9e00e92ef73da55fabcd01286ffc92
1.8.19	sudo-1.8.19.tar.gz	1130923534b62c18b40b529c6877d1a020db93f876617b56a569d0a1133d0228
1.8.18p1	sudo-1.8.18p1.tar.gz	e5a0471c721281a693025bbde33ebd9d3db43245d83ab8516bbfc23980379434
1.8.18	sudo-1.8.18.tar.gz	8519e99e97fa51ac50fca2030e76f9aa5195f543ae2d15107753f4e4c4e3be13
1.8.17p1	sudo-1.8.17p1.tar.gz	c690d707fb561b3ecdf6a6de5563bc0b769388eff201c851edbace408bb155cc
1.8.17	sudo-1.8.17.tar.gz	62b12c4fa9a3ad4f20f6e7576bc6405b2ec8d76222ea44a1c94830c68cccec8c
1.8.16	sudo-1.8.16.tar.gz	2d83826fc5125bf073acc203dbda1cf2abeee017090ccc9dddb0431a53d5064d
1.8.15	sudo-1.8.15.tar.gz	4316381708324da8b6cb151f655c1a11855207c7c02244d8ffdea5104d7cc308
1.8.14p3	sudo-1.8.14p3.tar.gz	a8a697cbb113859058944850d098464618254804cf97961dee926429f00a1237
1.8.14p2	sudo-1.8.14p2.tar.gz	b4bca9cca52fc6a409709995014af5e9fb905a4a6c5bda977f78e568954dfe21
1.8.14p1	sudo-1.8.14p1.tar.gz	b12ccdf1c0b6a2a494afb6616d16d90310206f4d8e68023cf27345396d9f06a0
1.8.14	sudo-1.8.14.tar.gz	74308f7bf242f6f997d4c8145849581f06fb6fbe47032b6e87ac664c14b9f6d3
1.8.13	sudo-1.8.13.tar.gz	e374e5edf2c11c00d6916a9f51cb0ad15e51c7b028370fa15169b07e61e05a25
1.8.12	sudo-1.8.12.tar.gz	163b51841de8ad19276581a6782d61f5948f1f72a0a843371a1c167d3dc4f3b0
1.8.11p2	sudo-1.8.11p2.tar.gz	8133849418fa18cf6b6bb6893d1855ff7afe21db8923234a00bf045c90fba1ad
1.8.11p1	sudo-1.8.11p1.tar.gz	44c275772595a119185336164bb76b6e08f23d38aa0fe0d6bab48812e75d6a43
1.8.11	sudo-1.8.11.tar.gz	a3177de7b5fbebfb43b32fc30aecaaf434762bf23e313de4c4a39e5ff715c845
1.8.10p3	sudo-1.8.10p3.tar.gz	6eda135fa68163108f1c24de6975de5ddb09d75730bb62d6390bda7b04345400
1.8.10p2	sudo-1.8.10p2.tar.gz	ba6cb8db6dccdb92a96e8ae63ca65c410f8b61270b603ab9af4b1154fef379f1
1.8.10p1	sudo-1.8.10p1.tar.gz	bc0426b315c6e9d470b6fdb8d6afa6d924332c1ad24c8303f6b52e81fa1f32fb
1.8.10	sudo-1.8.10.tar.gz	781296ec571e2595cfaa13846902ea03684ef826f261d61e6705da90a4f904aa
1.8.9p5	sudo-1.8.9p5.tar.gz	bc9d5c96de5f8b4d2b014f87a37870aef60d2891c869202454069150a21a5c21
1.8.9p4	sudo-1.8.9p4.tar.gz	1943f9e9409c6542935d2e2d862c48d0d69dcf27288b294b8b537c02f52ac7a7
1.8.9p3	sudo-1.8.9p3.tar.gz	a2b1f0ec8aeb929c8430b1514cb53e2c2f882ea26cbb43426883d1cb6d22c5b7
1.8.9p2	sudo-1.8.9p2.tar.gz	661d2e75fd35f5ce507d0b6fbd295bb155ae1da7e844cb6ef5996ecd01c5a13a
1.8.9p1	sudo-1.8.9p1.tar.gz	c22089aa1023233bf27808e8f7611b6b4c4fec2d151616179e1898876703cd51
1.8.9	sudo-1.8.9.tar.gz	48e1135cc0af9581f41a8945e083613ad7f6e083f5040086a14f6c500932dc16
1.8.8	sudo-1.8.8.tar.gz	9f911c1e9297fb8006deb52fa81197a8d06b9d54e70672f723c467ecae992fc9
1.8.7	sudo-1.8.7.tar.gz	39626cf3d48c4fd5a9139a2627d42bfefac7ce47f470bdba3aeb4e3d7c49566a
1.8.6p8	sudo-1.8.6p8.tar.gz	c0baaa87f59153967b650a0dde2f7d4147d358fa15f3fdabb47e84d0282fe625
1.8.5p3	sudo-1.8.5p3.tar.gz	00bbf27d53e8a74ef3e76b531c2b8a8d6dccab58e0d040c2a3a08171543bb1a7
1.8.4p5	sudo-1.8.4p5.tar.gz	cf41ea1ada17c0dfbd8480dd9dc800999e0db9f2972ffa8f7a2944751ad32aba
1.8.3p2	sudo-1.8.3p2.tar.gz	7edcf02ef4dc4f26f524726e8faaa90d7939772c186409ab150d2934e3a9ba31
1.8.2	sudo-1.8.2.tar.gz	37fe6ee670329bc45937fbe402e847f80b3a0a1c8fc9a66487e92b4b810152b0
1.8.1p2	sudo-1.8.1p2.tar.gz	281f90c80547cf22132e351e7f61c25ba4ba9cf393438468f318f9a7884026fb
1.8.0	sudo-1.8.0.tar.gz	75e11dd37e04df08357037526523ad7f9c340e53ab94d9667a406945bb9c892c
All Versions	master site

Beta Packages

Mon, 01 Jan 0001 00:00:00 +0000

These packages correspond to the current sudo development release. For information on how the binary packages are built, see building packages.

Cvtsudoers Manual

Mon, 01 Jan 0001 00:00:00 +0000

Sudo

A Short Introduction

README

The sudo philosophy

Where to find sudo

Source Repo

Cloning the sudo source repo via git

Stable Release

Sudo 1.9.17p2

Download Sudo

Legacy Release

Sudo 1.8.32

Manual Pages (all versions)

README.LDAP

Security Policy

Reporting Security Issues

Source Distribution

Development Release

Prebuilt Packages

Static Analysis

Download Mirrors

HTTP Mirrors

FTP Mirrors

Fuzzing Sudo

Sudo Installation Notes

System requirements

Sudo Upgrade Notes

A Brief History of Sudo

The Early Years

Contributing to Sudo

Getting started

Filing bug reports/issues

Sanitizers and Sudo

Building sudo with sanitizer support

Troubleshooting FAQ

When I run configure, it says “C compiler cannot create executables”.

Building Sudo Packages

Contributors

Mirroring Sudo

Other Documentation

Translations

Sudo Alternatives

Open Source Sudo Alternatives

Sudo Plugins

ChangeLog

Sudo License

Sudo Logo

Sudo Sandwich Logo

Sudo Shield Logo

Export Controls

Use of encryption

Local Privilege Escalation via chroot option

Sudo versions affected:

CVE ID:

Local Privilege Escalation via host option

Why sudo 1.9.16 enables secure_path by default?

Before you begin

When it comes to sudo logging, pretty is not always better

Before you begin

More info with -ll in sudo 1.9.15

Before you begin

Double free with per-command chroot sudoers rules

Sudo versions affected:

CVE ID:

The list pseudo-command

Before you begin

Sudoedit can edit arbitrary files

Sudo versions affected:

CVE ID:

Running sudo without updating cached credentials

Before you begin

Central configuration and session analytics for sudo

Sudo 1.9.11: sub-command detection improved on Linux

Before you begin

Looking inside sudo shell sessions: auditd, session recordings, log_subcmds

Sudo for blue teams: how to control and log better

Sudo 1.9.10: hiding passwords in session recordings

Sudo 1.9.10: using regular expressions in the sudoers file

cvtsudoers: merging multiple sudoers files into one

cvtsudoers: not just for LDAP