In Fedora Cloud Base 27 how is the 'fedora' user configured so that it can do password-less sudo?

[Paul Gier]

I'm running a Fedora Cloud Base 27 instance in openstack and ssh using the 'fedora' user works fine, and I can sudo without a password.  However, if I add a new user 'foobar' and add this user to the wheel group, this user needs a password in order to use sudo.  This makes sense based on the config in /etc/sudoers which has '%wheel  ALL=(ALL)       ALL'.  But I'm wondering how is the 'fedora' user configured so that it's in the same wheel group and can sudo without a password?

[Matthew Miller]

On Fri, Dec 08, 2017 at 08:08:18PM -0000, Paul Gier wrote:
> I'm running a Fedora Cloud Base 27 instance in openstack and ssh
> using the 'fedora' user works fine, and I can sudo without a
> password. However, if I add a new user 'foobar' and add this user to
> the wheel group, this user needs a password in order to use sudo.
> This makes sense based on the config in /etc/sudoers which has
> '%wheel ALL=(ALL) ALL'. But I'm wondering how is the 'fedora' user
> configured so that it's in the same wheel group and can sudo without
> a password?

The fedora user is created by cloud init, and that creates
/etc/sudoers.d/90-cloud-init-users, which looks like this:

# Created by cloud-init v. 0.7.9 on Sun, 10 Dec 2017 20:17:02 +0000

# User rules for fedora
  fedora ALL=(ALL) NOPASSWD:ALL

Look at /etc/cloud/cloud.cfg for where this comes from. You can
override this with your new user information when you provision the
instance.