Annotation of src/usr.bin/sudo/INSTALL, Revision 1.1.1.1
1.1 millert 1: Installation instructions for Sudo 1.6
2: ======================================
3:
4: Sudo uses a `configure' script to probe the capabilities and type
5: of the system in question. In this release, `configure' takes many
6: more options than it did before. Please read this document fully
7: before configuring and building sudo. You may also wish to read the
8: file INSTALL.configure which explains more about the `configure' script.
9:
10: Simple sudo installation
11: ========================
12:
13: For most systems and configurations it is possible simply to:
14:
15: 0) If you are upgrading from a previous version of sudo
16: please read the info in the UPGRADE file before proceeding.
17:
18: 1) If you previously ran `configure' on a different host
19: you will probably want to do a `make distclean' to remove
20: the old `config.cache' file. Otherwise, `configure'
21: will complain and refuse to run. Alternately, one can
22: simply `rm config.cache'.
23:
24: 2) Read the `OS dependent notes' section for any particular
25: "gotchas" relating to your operating system.
26:
27: 3) `cd' to the source or build directory and type `./configure'
28: to generate a Makefile and config.h file suitable for
29: building sudo. Before you actually run configure you
30: should read the `Available configure options' section
31: to see if there are any special options you may want
32: or need. Also of interest may be the section on
33: `Mixing password authentication schemes'.
34:
35: 4) Edit the configure-generated Makefile if you wish to
36: change any of the default paths (alternately you could
37: have changed the paths via options to `configure'.
38:
39: 5) Type `make' to compile sudo. If you are building sudo
40: in a separate build tree (apart from the sudo source)
41: GNU make will probably be required. If `configure' did
42: its job properly (and you have a supported configuration)
43: there won't be any problems. If this doesn't work, take
44: a look at the files TROUBLESHOOTING and PORTING for tips
45: on what might have gone wrong. Please mail us if you have a
46: fix or if you are unable to come up with a fix (address at EOF).
47:
48: 6) Type `make install' (as root) to install sudo, visudo, the
49: man pages, and a skeleton sudoers file. Note that the install
50: will not overwrite an existing sudoers file. You can also
51: install various pieces the package via the install-binaries,
52: install-man, and install-sudoers make targets.
53:
54: 7) Edit the sudoers file with `visudo' as necessary for your
55: site. You will probably want to refer the sample.sudoers
56: file and sudoers man page included with the sudo package.
57:
58: 8) If you want to use syslogd(8) to do the logging, you'll need
59: to update your /etc/syslog.conf file. See the sample.syslog.conf
60: file included in the distribution for an example.
61:
62: Available configure options
63: ===========================
64:
65: This section describes flags accepted by the sudo's `configure' script.
66: Defaults are listed in brackets after the description.
67:
68: Configuration:
69: --cache-file=FILE
70: Cache test results in FILE
71:
72: --help
73: Print the usage/help info
74:
75: --no-create
76: Do not create output files
77:
78: --quiet, --silent
79: Do not print `checking...' messages
80:
81: Directory and file names:
82: --prefix=PREFIX
83: Install architecture-independent files in PREFIX This really only
84: applies to man pages. [/usr/local]
85:
86: --exec-prefix=EPREFIX
87: Install architecture-dependent files in EPREFIX This includes the
88: sudo and visudo executables. [same as prefix]
89:
90: --bindir=DIR
91: Install `sudo' in DIR [EPREFIX/bin]
92:
93: --sbindir=DIR
94: Install `visudo' in DIR [EPREFIX/sbin]
95:
96: --sysconfdir=DIR
97: Install `sudoers' file in DIR [/etc]
98:
99: --mandir=DIR
100: Install man pages in DIR [PREFIX/man]
101:
102: --srcdir=DIR
103: Find the sources in DIR [configure dir or ..]
104:
105: Special features/options:
106: --with-CC=path
107: Specifies path to C compiler you wish to use.
108:
109: --with-incpath
110: Adds the specified directories to CPPFLAGS so configure and the
111: compiler will look there for include files. Multiple directories
112: may be specified as long as they are space separated.
113: Eg: --with-incpath="/usr/local/include /opt/include"
114:
115: --with-libpath
116: Adds the specified directories to SUDO_LDFLAGS and VISUDO_LDFLAGS so
117: configure and the compiler will look there for libraries. Multiple
118: directories may be specified as with --with-incpath.
119:
120: --with-libraries
121: Adds the specified libaries to SUDO_LIBS and and VISUDO_LIBS so sudo
122: will link against them. If the library doesn't start with `-l' or end
123: in `.a' or `.o' a `-l' will be prepended to it. Multiple libraries may
124: be specified as long as they are space separated.
125:
126: --with-csops
127: Add CSOps standard options. You probably aren't interested in this.
128:
129: --with-skey
130: Enable S/Key OTP (One Time Password) support.
131:
132: --with-opie
133: Enable NRL OPIE OTP (One Time Password) support.
134:
135: --with-SecurID=DIR
136: Enable SecurID support. If specified, DIR is directory containing
137: sdiclient.a, sdi_athd.h, sdconf.h, and sdacmvls.h.
138:
139: --with-fwtk=DIR
140: Enable TIS Firewall Toolkit (FWTK) 'authsrv' support. If specified,
141: DIR is the base directory containing the compiled FWTK package
142: (or at least the library and header files).
143:
144: --with-kerb4
145: Enable kerberos v4 support. Tested only with the Cygnus Network
146: Security package (CNS). This uses kerberos passphrases for
147: authentication but does not use the kerberos cookie scheme.
148:
149: --with-kerb5
150: Enable kerberos v5 support. Tested against MIT Kerberos V,
151: release 1.1, although also expected to work against CNS. This
152: This uses kerberos passphrases for authentication but does not
153: use the kerberos cookie scheme. Will not work for Kerberos V
154: older than version 1.1.
155:
156: --with-authenticate
157: Enable support for the AIX 4.x general authentication function.
158: This will use the authentication scheme specified for the user
159: on the machine.
160:
161: --with-pam
162: Enable PAM support. Tested on Redhat Linux 5.x and Solaris 2.6.
163:
164: --with-AFS
165: Enable AFS support with kerberos authentication. Should work under
166: AFS 3.3. If your AFS doesn't have -laudit you should be able to
167: link without it.
168:
169: --with-DCE
170: Enable DCE support. Known to work on HP-UX 9.X and 10.0. Other
171: platforms may require source code and/or `configure' changes.
172:
173: --disable-sia
174: Disable SIA support. This is the "Security Integration Architecture"
175: on Digital UNIX. If you disable SIA sudo will use its own
176: authentication routines.
177:
178: --disable-shadow
179: Disable shadow password support. Normally, sudo will compile in shadow
180: password support and use a shadow password if it exists.
181:
182: --with-sudoers-mode=mode
183: File mode for the sudoers file (octal). Note that if you wish to
184: NFS-mount the sudoers file this must be group readable. Also note
185: that this is actually set in the Makefile. The default mode is 0440.
186:
187: --with-sudoers-uid
188: User id that "owns" the sudoers file. Note that this is the numeric
189: id, *not* the symbolic name. Also note that this is actually set in
190: the Makefile. The default is 0.
191:
192: --with-sudoers-gid
193: Group id that "owns" the sudoers file. Note that this is the numeric
194: id, *not* the symbolic name. Also note that this is actually set in
195: the Makefile. The default is 0.
196:
197: --with-execv
198: Use execv() to exec the command instead of execvp(). I can't think of
199: a reason to actually do this since execvp() is passed a fully qualified
200: pathname but someone might thoroughly distrust execvp(). Note that if
201: you define this you lose the ability to exec scripts that are missing
202: the '#!/bin/sh' cookie (like /bin/kill on SunOS and /etc/fastboot on
203: 4.3BSD). This is off by default.
204:
205: --without-interfaces
206: This option keeps sudo from trying to glean the ip address from each
207: attached ethernet interface. It is only useful on a machine where
208: sudo's interface reading support does not work, which may be the case
209: on some SysV-based OS's using STREAMS.
210:
211: --without-passwd
212: This option authentication via the passwd (or shadow) file.
213: It should only be used when another, alternate, authentication
214: scheme is in use.
215:
216: --with-editor=path
217: Specify the default editor used by visudo (and the only editor used
218: unless --with-env-editor is specified). The default is the path
219: to vi on your system.
220:
221: --with-env-editor
222: Makes visudo consult the EDITOR and VISUAL environment variables before
223: falling back on the default editor. Note that this may create a
224: security hole as most editors allow a user to get a shell (which would
225: be a root shell and hence, no logging).
226:
227: The following options are also configurable at runtime:
228:
229: --with-otp-only
230: This option is now just an alias for --without-passwd.
231:
232: --with-long-otp-prompt
233: When validating with a One Time Password scheme (S/Key or OPIE), a
234: two-line prompt is used to make it easier to cut and paste the
235: challenge to a local window. It's not as pretty as the default but
236: some people find it more convenient.
237:
238: --with-logging=TYPE
239: How you want to do your logging. You may choose "syslog", "file",
240: or "both". Setting this to "syslog" is nice because you can keep all
241: of your sudo logs in one place (see the FAQ). The default is "syslog".
242:
243: --with-logfac=FACILITY
244: Determines which syslog facility to log to. This requires a 4.3BSD
245: or later version of syslog. You can still set this for ancient
246: syslogs but it will have no effect. The following facilities are
247: supported: authpriv (if your OS supports it), auth, daemon, user,
248: local0, local1, local2, local3, local4, local5, local6, and local7.
249:
250: --with-goodpri=PRIORITY
251: Determines which syslog priority to log successfully authenticated
252: commands. The following priorities are supported: alert, crit,
253: debug, emerg, err, info, notice, and warning.
254:
255: --with-badpri=PRIORITY
256: Determines which syslog priority to log unauthenticated commands
257: and errors. The following priorities are supported: alert, crit,
258: debug, emerg, err, info, notice, and warning.
259:
260: --with-logpath=path
261: Override the default location of the sudo log file and use "path"
262: instead. By default will use /var/log/sudo.log if there is a /var/log
263: dir, falling back to /var/adm/sudo.log or /usr/adm/sudo.log if not.
264:
265: --with-loglen
266: Number of characters per line for the file log. This is only used if
267: you are to "file" or "both". This value is used to decide when to wrap
268: lines for nicer log files. The default is 80. Setting this to 0
269: will disable the wrapping.
270:
271: --with-ignore-dot
272: If set, sudo will ignore '.' or '' (current dir) in $PATH.
273: The $PATH itself is not modified.
274:
275: --with-mailto
276: User that mail from sudo is sent to. This should go to a sysadmin at
277: your site. The default is "root".
278:
279: --with-mailsubject
280: Subject of the mail sent to the "mailto" user. The token "%h"
281: will expand to the hostname of the machine.
282: Default is "*** SECURITY information for %h ***".
283:
284: --without-mail-if-no-user
285: Normally, sudo will mail to the "alermail" user if the user invoking
286: sudo is not in the sudoers file. This option disables that behavior.
287:
288: --with-mail-if-no-host
289: Send mail to the "alermail" user if the user exists in the sudoers
290: file, but is not allowed to run commands on the current host.
291:
292: --with-mail-if-noperms
293: Send mail to the "alermail" user if the user is allowed to use sudo but
294: the command they are trying is not listed in their sudoers file entry.
295:
296: --with-passprompt
297: Default prompt to use when asking for a password; can be overridden
298: via the -p option and the SUDO_PROMPT environment variable. Supports
299: two escapes: "%u" expands to the user's login name and "%h" expands
300: to the local hostname. Default is "Password:".
301:
302: --with-badpass-message
303: Message that is displayed if a user enters an incorrect password.
304: The default is "Sorry, try again." unless insults are turned on.
305:
306: --with-fqdn
307: Define this if you want to put fully qualified hostnames in the sudoers
308: file. Ie: instead of myhost you would use myhost.mydomain.edu. You may
309: still use the short form if you wish (and even mix the two). Beware
310: that turning FQDN on requires sudo to make DNS lookups which may make
311: sudo unusable if your DNS is totally hosed. Also note that you must
312: use the host's official name as DNS knows it. That is, you may not use
313: a host alias (CNAME entry) due to performance issues and the fact that
314: there is no way to get all aliases from DNS.
315:
316: --with-timedir=path
317: Override the default location of the sudo timestamp directory and
318: use "path" instead.
319:
320: --with-sendmail=path
321: Override configure's guess as to the location of sendmail.
322:
323: --without-sendmail
324: Do not use sendmail to mail messages to the "mailto" user.
325: Use only if don't run sendmail or the equivalent.
326:
327: --with-umask
328: Umask to use when running the root command. The default is 0022.
329:
330: --without-umask
331: Preserves the umask of the user invoking sudo.
332:
333: --with-runas-default=user
334: The default user to run commands as if the -u flag is not specified
335: on the command line. This defaults to "root".
336:
337: --with-exempt=group
338: Users in the specified group don't need to enter a password when
339: running sudo. This may be useful for sites that don't want their
340: "core" sysadmins to have to enter a password but where Jr. sysadmins
341: need to. You should probably use NOPASSWD in sudoers instead.
342:
343: --with-passwd-tries=tries
344: Number of tries a user gets to enter his/her password before sudo logs
345: the failure and exits. The default is 3.
346:
347: --with-timeout=minutes
348: Number of minutes that can elapse before sudo will ask for a passwd
349: again. The default is 5, set this to 0 to always prompt for a password.
350:
351: --with-password-timeout=minutes
352: Number of minutes before the sudo password prompt times out.
353: The default is 5, set this to 0 for no password timeout.
354:
355: --with-tty-tickets
356: This makes sudo use a different ticket file for each tty (per user).
357: Ie: instead of the ticket file being "username" it is "username:tty".
358: This is useful for "shared" accounts like "operator". Note that this
359: means that there will be more files in the timestamp dir. This is not
360: a problem if your system has a cron job to remove of files from /tmp
361: (or wherever you specified the timestamp dir to be).
362:
363: --with-insults
364: Define this if you want to be insulted for typing an incorrect password
365: just like the original sudo(8). This is off by default.
366:
367: --with-all-insults
368: Include all the insult sets listed below.
369:
370: --with-classic-insults
371: Uses insults from sudo "classic." If you just specify --with-insults
372: you will get the classic and CSOps insults. This is on by default if
373: --with-insults is given.
374:
375: --with-csops-insults
376: Insults the user with an extra set of insults (some quotes, some
377: original) from a sysadmin group at CU (CSOps). You must specify
378: --with-insults as well for this to have any effect. This is on by
379: default if --with-insults is given.
380:
381: --with-hal-insults
382: Uses 2001-like insults when an incorrect password is entered.
383: You must specify --with-insults as well for this to have any effect.
384:
385: --with-goons-insults
386: Insults the user with lines from the "Goon Show" when an incorrect
387: password is entered. You must specify --with-insults as well for
388: this to have any effect.
389:
390: --with-secure-path[=path]
391: Path used for every command run from sudo(8). If you don't trust the
392: people running sudo to have a sane PATH environment variable you may
393: want to use this. Another use is if you want to have the "root path"
394: be separate from the "user path." You will need to customize the path
395: for your site. NOTE: this is not applied to users in the group
396: specified by --with-exemptgroup. If you do not specify a path,
397: "/bin:/usr/ucb:/usr/bin:/usr/sbin:/sbin:/usr/etc:/etc" is used.
398:
399: --without-lecture
400: Don't print the lecture the first time a user runs sudo.
401:
402: --disable-authentication
403: By default, sudo requires the user to authenticate via a
404: password or similar means. This options causes sudo to
405: *not* require authentication. It is possible to turn
406: authentication back on in sudoers via the PASSWD attribute.
407:
408: --disable-root-sudo
409: Don't let root run sudo. This can be used to prevent people from
410: "chaining" sudo commands to get a root shell by doing something
411: like "sudo sudo /bin/sh".
412:
413: --enable-log-host
414: Log the hostname in the log file.
415:
416: --enable-noargs-shell
417: If sudo is invoked with no arguments it acts as if the "-s" flag had
418: been given. That is, it runs a shell as root (the shell is determined
419: by the SHELL environment variable, falling back on the shell listed
420: in the invoking user's /etc/passwd entry).
421:
422: --enable-shell-sets-home
423: If sudo is invoked with the "-s" flag the HOME environment variable
424: will be set to the home directory of the target user (which is root
425: unless the "-u" option is used). This option effectively makes the
426: "-s" flag imply "-H".
427:
428: --disable-path-info
429: Normally, sudo will tell the user when a command could not be found
430: in their $PATH. Some sites may wish to disable this as it could
431: be used to gather information on the location of executables that
432: the normal user does not have access to. The disadvantage is that
433: if the executable is simply not in the user's path, sudo will tell
434: the user that they are not allowed to run it, which can be confusing.
435:
436: Shadow password and C2 support
437: ==============================
438:
439: Shadow passwords (also included with most C2 security packages) are
440: supported on most major platforms for which they exist. The
441: `configure' script will attempt to determine if your system can use
442: shadow passwords and include support for them if so. Shadow password
443: support is now compiled in by default (it doesn't hurt anything if you
444: don't have them configured). To disable the shadow password support,
445: use the --disable-shadow option to configure.
446:
447: Shadow passwords are known to work on the following platforms:
448:
449: SunOS 4.x
450: Solaris 2.x
451: HP-UX >= 9.x
452: Ultrix 4.x
453: Digital UNIX
454: IRIX >= 5.x
455: AIX >= 3.2.x
456: ConvexOS with C2 security (not tested recently)
457: Linux
458: SCO >= 3.2.2
459: Pyramid DC/OSx
460: UnixWare
461: SVR4 (and variants using standard SVR4 shadow passwords)
462: 4.4BSD based systems (including OpenBSD, NetBSD, FreeBSD, and BSD/OS)
463: OS's using SecureWare's C2 security.
464:
465: OS dependent notes
466: ==================
467:
468: OpenBSD < 2.2 and NetBSD < 1.2.1:
469: The fdesc filesystem has a bug wrt /dev/tty handling that
470: causes sudo to hang at the password prompt. The workaround
471: is to run configure with --with-password-timeout=0
472:
473: Solaris 2.x:
474: You need to have a C compiler in order to build sudo.
475: Since Solaris 2.x does not come with one by default this
476: means that you either need to have purchased the unbundled Sun
477: C compiler or have a copy of the GNU C compiler (gcc).
478: The SunSoft Catalyst CD should contain gcc binaries for
479: Solaris. You can also get them from various places on the
480: net, including http://www.sunfreeware.com/
481: NOTE: sudo will *not* build with the sun C compiler in BSD
482: compatibility mode (/usr/ucb/cc). Sudo is designed to
483: compile with the standard C compiler (or gcc) and will
484: not build correctly with /usr/ucb/cc. You can use the
485: `--with-CC' option to point `configure' to the non-ucb
486: compiler if it is not the first cc in your path. Some
487: sites link /usr/ucb/cc to gcc; configure will not notice
488: this an still refuse to use /usr/ucb/cc, so make sure gcc
489: is also in your path if your site is setup this way.
490: Also: Many versions of Solaris come with a broken syslogd.
491: If you have having problems with sudo logging you should
492: make sure you have the latest syslogd patch installed.
493: This is a problem for Solaris 2.4 and 2.5 at least.
494:
495: AIX 3.2.x:
496: I've had various problems with the AIX C compiler producing
497: incorrect code when the -O flag was used. When optimization
498: is not used, the problems go away. Gcc does not appear
499: to have this problem.
500:
501: Also, the AIX 3.2.x lex will not work with sudo's parse.lex.
502: This should not be a problem as sudo comes shipped with
503: a pre-generated lex.yy.c (created by flex). If you want
504: to modify the lex tokenizer, make sure you grab a copy of
505: flex from ftp.ee.lbl.gov (also available on most GNU mirrors)
506: and sudo will use that instead.
507:
508: Ultrix 4.x:
509: Ultrix still ships with the 4.2BSD syslog(3) which does not
510: allow things like logging different facilities to different
511: files, redirecting logs to a single loghost and other niceties.
512: You may want to just grab and install:
513: ftp://gatekeeper.dec.com/pub/DEC/jtkohl-syslog-complete.tar.Z
514: (available via anonymous ftp) which is a port if the 4.3BSD
515: syslog/syslogd that is backwards compatible with the Ultrix version.
516: I recommend it highly. If you do not do this you probably want
517: to run configure with --with-logging=file
518:
519: Digital UNIX:
520: By default, sudo will use SIA (Security Integration Architecture)
521: to validate a user. If you want to use an alternate authentication
522: method that does not go through SIA, you need to use the
523: --disable-sia option to configure. If you use gcc to compile
524: you will get warnings when building interfaces.c. These are
525: harmless but if they really bug you, you can edit
526: /usr/include/net/if.h around line 123, right after the comment:
527: /* forward decls for C++ */
528: change the line:
529: #ifdef __cplusplus
530: to:
531: #if defined(__cplusplus) || defined(__GNUC__)
532: If you don't like the idea of editing the system header file
533: you can just make a copy in gcc's private include tree and
534: edit that.
535:
536: Linux:
537: NOTE: Reportedly, Linux's execvp(3) doesn't always execute
538: scripts that lack the "#!/some/shell" header correctly.
539: The workaround is to give all your scripts a proper
540: header.
541: Versions of glibc 2.x previous to 2.0.7 have a broken lsearch().
542: You will need to either upgrade to glibc-2.0.7 or use sudo's
543: version of lsearch(). To use sudo's lsearch(), comment out
544: the "#define HAVE_LSEARCH 1" line in config.h and add lsearch.o
545: to the LIBOBJS line in the Makefile.
546:
547: It is not possible to access the sudoers file via NFS on Linux.
548: This is due to a bug in the Linux client-side NFS implementation.
549: It has been fixed in the developement kernel but, as of Aug 27, 1999,
550: the fixes have not made it into the mainstream kernel.
551:
552: Mac OS X:
553: It has been reported that for sudo to work on Mac OS X it must
554: either be built with the --with-password-timeout=0 option or the
555: password timeout must be disabled in the Defaults line in the
556: sudoers file. If sudo just hangs when you try to enter a password,
557: you need to disable the password timeout (Note: this is not a bug
558: in sudo).
559:
560: SCO ODT:
561: You'll probably need libcrypt_i.a available via anonymous ftp
562: from sosco.sco.com. The necessary files are /SLS/lng225b.Z
563: and /SLS/lng225b.ltr.Z.