Sudo Command Control Policy

Fudo Enterprise 6.1 introduces sudo command control for Linux environments. The Sudo policy type enables Fudo Enterprise to authorize sudo commands executed by users during SSH sessions.

Important

  • This policy type works only with SSH sessions.

  • The Fudo sudo plugin must be installed on target Linux systems where sudo command control should be enforced. The plugin is available as a separate download from GitHub.

How Sudo Command Control Works

When sudo command control is enabled:

  1. Command Interception - The Fudo sudo plugin intercepts all sudo commands on the target system

  2. Policy Evaluation - Commands are sent to Fudo Enterprise for evaluation against configured policies

  3. Authorization Decision - Commands matching whitelist expressions are allowed; others are blocked

  4. Audit Trail - All sudo command attempts are logged with full context

  5. Real-time Notifications - Administrators receive alerts based on policy configuration

Setting up Fudo for Sudo Control

Complete these steps in Fudo Enterprise to enable sudo command control:

Step 1: Configure API Access

Create user with an API Key authentication method and ALL required privileges:

  • user-read

  • policy-read

  • regexp-read

  • session-read

  • sudo-approval

Warning

Missing any single privilege causes every sudo command to be denied.

Step 2: Configure Server Infrastructure

  1. Add the target Linux server:

    • Navigate to Session Management > Servers

    • Click Add server

    • Select SSH protocol

    • Configure server connection details

  2. Create an Account on that server:

    • Navigate to Session Management > Accounts

    • Click Add account

    • Select the server created in step 1

    • Configure account credentials

  3. Create a Safe:

    • Navigate to Session Management > Safes

    • Click Add safe

    • Link the Fudo user to the account created in step 2

Sudo Policy Configuration

Important

Before creating a Sudo policy, you must first define regular expressions that will match the sudo commands you want to allow. Sudo policies work exclusively with a whitelist approach - only commands matching the defined expressions will be permitted. The regular expressions must specify full binary paths (e.g., ^/usr/bin/sudo, ^/usr/bin/su$).

Create regular expressions:

  1. Select Session Management > Policies.

  2. Navigate to the Regular Expressions tab.

  3. Click Add regular expression.

  4. Enter a name for the expression (e.g., sudo_systemctl, sudo_apt_update).

  5. Define the pattern for allowed sudo commands. Important: Use full binary paths in your patterns (e.g., ^/usr/bin/su$, ^/usr/bin/sudo).

  6. Click Save.

../../_images/6-1-su-do-regex-details.png

After creating the necessary regular expressions, follow these steps to configure a Sudo policy:

  1. Select Session Management > Policies.

  2. Return to the Policies tab.

  3. Click Add Policy.

  4. Provide a name for the policy.

  5. Select the Severity (low, medium, high, critical). The severity parameter value is included in email notifications and in the Events log.

  6. In the Policy type section, select Sudo.

../../_images/6-1-su-do-policy-create.png

  1. Configure the Regular Expressions:

    • The policy type is Whitelist - sudo commands that match the selected expressions will be allowed.

    • Select from the previously created regular expressions that define allowed sudo commands.

    • Only expressions marked with checkboxes will be used in the policy.

    • If no expressions are available, you must first create them in the Regular Expressions tab.

  2. Configure command execution context (optional):

    • Run as user - Specify which user the sudo command can run as (e.g., root, www-data)

    • Run as group - Specify which group the sudo command can run as

  3. Configure Policy Behaviour - select actions to take when a sudo command is executed:

    • - Send email - Send email notification to administrators

    • - Send push - Send push notification to Fudo Officer mobile app

    • - SNMP Trap - Send SNMP TRAP notification

  1. Click Save.

Note

Fudo Officer 2.3.32 and later can notify users when sudo commands matching the configured policy are executed. This provides real-time visibility into privileged operations across your infrastructure.

Sudo Plugin Installation

The Fudo sudo plugin is required on each Linux system where you want to enforce sudo command control.

Requirements

  • Target Linux server with sudo 1.9 or newer (verify with sudo -V)

  • Root access on the target server

Warning

Critical Installation Precautions:

  1. Create a VM snapshot first - A misconfigured installation will deny ALL sudo commands on the server. A snapshot is the safest rollback method.

  2. Keep a second root SSH session open - Maintain a second SSH session logged in as root during installation. If the plugin breaks sudo, this is your only way to revert without restoring the snapshot.

  3. The plugin blocks ALL non-Fudo sudo - Local console sudo and direct (non-Fudo) SSH sudo are always denied as no Fudo session mapping exists for them. This is by design.

  4. Sudo 1.9+ required - The plugin requires sudo version 1.9 or newer. Ubuntu 20.04 LTS ships with sudo 1.8.31 and is incompatible. Verify your version with sudo -V before installation.

Setting Up the Target Linux Server

Complete the following steps in the specified order.

Warning

Steps 1 and 2 are required recovery safeguards and must not be skipped.

  1. Open a second SSH connection to the target server as root and keep it open. This connection provides a recovery path if the plugin installation or configuration fails.

  2. Create a VM snapshot.

  3. Check the installed sudo version:

    sudo -V | head -1

    The output must show sudo version 1.9.x or later.

  4. Copy the plugin file to the sudo plugin directory used by your Linux distribution:

    • Ubuntu/Debian: /usr/lib/sudo/

    • RHEL/Rocky/CentOS: /usr/libexec/sudo/

    Copy the fudo_approval.so file to the appropriate directory and make it readable by all users.

  5. Register the plugin in /etc/sudo.conf by adding the following line:

    Plugin fudo_approval fudo_approval.so api_url=https://<fudo_ip>

  6. Store the API key in /etc/fudo/approval.key.

    The plugin strictly validates the key file ownership and permissions. The file must be owned by root and its permissions must be set to exactly 0600. Otherwise, sudo commands are denied.

  7. Add the Fudo TLS certificate to the system trust store.

    Use the certificate trust mechanism required by your distribution, for example:

    • Debian-based distributions: update-ca-certificates

    • RHEL-based distributions: update-ca-trust

  8. Verify the configuration:

    sudo -V

    The fudo_approval plugin should appear in the sudo plugin list.

Warning

Do not close the recovery SSH connection until the plugin is visible in the sudo plugin list and sudo command execution has been verified.

Warning

The sudo plugin must be properly configured and tested before deploying to production systems. Misconfiguration can prevent legitimate sudo commands from executing.

Note

Direct sudo commands on the target server (outside of Fudo sessions) will always be denied. This is intentional - only commands executed through Fudo Enterprise sessions can be authorized.


Related topics: