Home / server / Questions / 1130738
Accepted
Giovanni Tirloni
Asked: 2023-05-09 21:22:20 +0800 CST

How to customize sudo permissions when using OS Login?

  • 772

When OS Login is enabled, and a user is granted access by having either the "Compute OS Login" or "Compute OS Admin Login" roles, they can run sudo.

In my experience, the per-user sudoers file always has this permission:

# cat /var/google-sudoers.d/first_last_example_com 
first_last_example_com ALL=(ALL) NOPASSWD: ALL

Is it possible to customize these permissions or even disable sudo completely for a specific user or group?

google-cloud-platform

1 Answers

  1. Best Answer

    A user with the role roles/compute.osLogin should be able to login but should not be able to run sudo.

    The role roles/compute.osAdminLogin is required to login and use sudo.

    Double-check the IAM roles you have assigned to users.

    There are roles that include roles/compute.osAdminLogin, so you might be granting admin rights without realizing it. If the user has the primitive roles/owner or roles/admin role, or if they have roles/compute.instanceAdmin, these roles already include instance access roles with administrator permissions.

    Google Compute Engine supports startup scripts link. You can remove users in the google-sudoers group by adding the following script.

    #!/bin/bash
sudo deluser USERNAME google-sudoers
    • 1