When Sudo Is Too Heavy – Doas

You already know that su requires a password for the target user.
sudo is a great tool for elevated privileges, but it’s heavy sometimes.

What would you use in a small, flexible environment?

doas is a smaller, lightweight tool for the same task.
Originally developed for OpenBSD, then opendoas is available on other BSD and Linux systems.

doas is small and easier to configure than sudo.
In exchange it doesn’t allow such a granular configuration and audit setup.

Yet in small environments doas is a viable competitor to sudo.

Smaller code base doesn’t automatically mean more secure.
But it can mean smaller exposure, of course.

Ansible supports doas as a privilege escalation method through its become system.

The choice is yours.

Install Doas

On Debian and compatible systems it’s part of the main repository.

You can install doas with apt as the root user:

su -
apt update
apt install opendoas

Configure Doas

If you use sudo for a couple of users or groups, doas will shine for you.

The configuration is managed in a single /etc/doas.conf file that you create.

touch /etc/doas.conf

The configuration file format is extremely simple.

Create a rule for your localadmins group:

permit :localadmins as root

Do you want to keep the authentication valid for some time?

permit persist :localadmins as root

Depending on how OpenDoas was built, persistence support may not be available.

If you need passwordless doas for a specific user called joe:

permit nopass joe as root

OpenDoas supports checking the configuration:

doas -C /etc/doas.conf

It’s this simple.

Harden The Configuration

Do not let the configuration file in that state.
Other users may read its content.

Make it only readable by the root user.

chown root:root /etc/doas.conf
chmod 0400 /etc/doas.conf

Other users won’t be able to read its contents.

Final Thoughts

You can see doas is very similar to sudo.
You set it up, and you let it work.

Basic audit logging is available through syslog.
On systems using journald, you can also inspect the journal.
It can be disabled by the nolog option in the configuration file.

If you use BASH, and you installed bash-completion, add it to your .bashrc:

complete -F _command doas

doas is a nice solution if sudo is too heavy for your environment.

If you have any comments, talk to us:

IRC : irc.silentarchitect.org
Port : 6697
Channel : #tomsitcafe

If you don’t want to join our private IRC, visit our public Discord server: https://discord.gg/nxvna45STM