Skip to content

Update sudo logging configuration in Ansible tasks#1002

Closed
dhruvmicrosoft wants to merge 1 commit intoAzure:mainfrom
dhruvmicrosoft:dhruvmicrosoft-sudoers-fix
Closed

Update sudo logging configuration in Ansible tasks#1002
dhruvmicrosoft wants to merge 1 commit intoAzure:mainfrom
dhruvmicrosoft:dhruvmicrosoft-sudoers-fix

Conversation

@dhruvmicrosoft
Copy link

This pull request improves the way the Ansible role configures sudo logging by making the location of the sudoers configuration more robust and compliant with best practices. The changes ensure that, when possible, sudo logging configuration is placed in /etc/sudoers.d/99-sudo-logging instead of modifying the main /etc/sudoers file, and that the file is created with the correct permissions.

Key improvements to sudoers configuration:

  • Added a check to determine if the /etc/sudoers.d directory exists, enabling conditional placement of the logging configuration.
  • Updated the logic to select the appropriate sudoers file location, preferring /etc/sudoers.d/99-sudo-logging when available, and defaulting to /etc/sudoers otherwise.
  • Modified the block that enables sudo logging to use the chosen file location, and ensured the file is created with mode 0440 for security.

@dhruvmicrosoft dhruvmicrosoft requested a review from a team as a code owner January 23, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant