blob: d05bb5a565f810efb883c31540ce595925727681 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
<!doctype html>
<html lang="EN">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="/style.css">
<title>Replace sudo with doas on Artix</title>
</head>
<body>
<header>
<h1>Bloggings</h1>
<a href="/index.php">Back</a>
</header>
<main>
<article>
<h2>Replace sudo with doas on Artix</h2>
<h3>2025-06-18</h3>
<h4>More efficient, less complicated</h4>
<p>Sudo is quite bloated and not without security problems. It is intended to cover situations
that normal Linux users will never encounter, and its configuration is messy.</p>
<p>Doas is an application from OpenBSD that is simpler and cleaner.</p>
<p>Here are the steps I took to install doas and replace sudo:</p>
<code>sudo pacman -S opendoas</code>
<p>Add my username to the group wheel:</p>
<code>sudo usermod -aG wheel philip</code>
<p>Create /etc/doas.conf and add:</p>
<code>permit setenv {PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin} :wheel</code>
<p>Modify the ownership and permissions:</p>
<code>doas chown -c root:root /etc/doas.conf
doas chmod -c 0400 /etc/doas.conf
</code>
<p>You should now be able to remove sudo:</p>
<code>doas pacman -Rdd sudo</code>
<p>Create a symlink to sudo</p>
<code>ln -s $(which doas) /usr/bin/sudo</code>
<p>So now it would be nice to have the equivalent of sudoedit.</p>
<p>Create /root/scripts/doasedit (I use the micro editor):</p>
<code>#!/usr/bin/env bash
DOASDIR="/tmp/doas-$(date +%s)"
mkdir $DOASDIR
chmod 700 $DOASDIR
DOASFILE="$DOASDIR/doas.conf"
cp /etc/doas.conf $DOASFILE
chmod 600 $DOASFILE
micro $DOASFILE
sync
doas -C $DOASFILE && echo "valid config" && cp $DOASFILE /etc/doas.conf && chmod 400 /etc/doas.conf || echo "invalid config"
sync
rm -rf $DOASDIR
</code>
<p>Create /usr/local/bin/doasedit:</p>
<code>#!/usr/bin/env bash
if [ "$(id -u)" != 0 ]; then
doas /root/script/doasedit
else
/root/script/doasedit
fi
</code>
<p>Modify the permissions</p>
<code>doas chmod 700 /root/script/doasedit
doas chmod 755 /usr/local/bin/doasedit
</code>
<p>Test doasedit:</p>
<code>doasedit</code>
<p>add this line:</p>
<code>permit nopass philip as root cmd pacman</code>
<p>save and you should see:</p>
<code>valid config</code>
<p><a href="https://www.cjjackson.dev/posts/replacing-sudo-with-doas-on-arch-linux/">Source</a></p>
</article>
</main>
<footer>
<p> </p>
<p>§</p>
</footer>
</body>
</html>
|
