doas
| doas | |
|---|---|
| Original author | Ted Unangst |
| Developer | OpenBSD Project[1] |
| Initial release | 18 October 2015[1] |
| Stable release | [2]
/ |
| Repository |
|
| Written in | C |
| Engine | |
| Type | Security software |
| License | ISC license |
| Website | man |
doas (“dedicated openbsd application subexecutor”)[3] is a program to execute commands as another user. The system administrator can configure it to give specified users privileges to execute specified commands. It is free and open-source under the ISC license[4] and available in Unix and Unix-like operating systems.
doas was developed by Ted Unangst[5] for OpenBSD as a simpler and safer sudo replacement.[6][7] Unangst himself had issues with the default sudo config, which was his motivation to develop doas.[3] doas was released with OpenBSD 5.8 in October 2015 replacing sudo.[1] However, OpenBSD still provides sudo as a package.[1]
Configuration
[edit | edit source]Definition of privileges should be written in the configuration file, /etc/doas.conf.[8] The syntax used in the configuration file is inspired by the packet filter configuration file.[3]
Examples
[edit | edit source]Allow user1 to execute procmap as root without password:[citation needed]
permit nopass user1 as root cmd /usr/sbin/procmap
Allow members of the wheel group to run any command as root:
permit :wheel as root
Simpler version (only works if default user is root, which it is after install):
permit :wheel
To allow members of wheel group to run any command (default as root) and remember that they entered the password:
permit persist :wheel
Ports and availability
[edit | edit source]Jesse Smith’s[9] port of doas is packaged for DragonFlyBSD,[10] FreeBSD,[11] and NetBSD.[12] According to the author, it also works on illumos and macOS.[13]
OpenDoas, a Linux port, is packaged for Debian, Alpine, Arch, CRUX, Fedora, Gentoo, GNU Guix, Hyperbola, Manjaro, Parabola, NixOS, Ubuntu, and Void Linux.[14] Starting with Alpine Linux v3.16 release, OpenDoas became the suggested replacement for sudo, which got its security maintenance time reduced within the distribution.[15]
See also
[edit | edit source]References
[edit | edit source]- ^ a b c d Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ a b c Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ – OpenBSD General Commands Manual
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).