In Fedora Cloud Base 27 how is the 'fedora' user configured so that it can do password-less sudo?

[Paul Gier]

I'm running a Fedora Cloud Base 27 instance in openstack and ssh using the
'fedora' user works fine, and I can sudo without a password.  However, if I add a
new user 'foobar' and add this user to the wheel group, this user needs a password
in order to use sudo.  This makes sense based on the config in /etc/sudoers which has
'%wheel  ALL=(ALL)       ALL'.  But I'm wondering how is the 'fedora'
user configured so that it's in the same wheel group and can sudo without a password?

[Matthew Miller]

On Fri, Dec 08, 2017 at 08:08:18PM -0000, Paul Gier wrote:
>  I'm running a Fedora Cloud Base 27 instance in openstack and ssh
>  using the 'fedora' user works fine, and I can sudo without a
>  password. However, if I add a new user 'foobar' and add this user to
>  the wheel group, this user needs a password in order to use sudo.
>  This makes sense based on the config in /etc/sudoers which has
>  '%wheel ALL=(ALL) ALL'. But I'm wondering how is the 'fedora' user
>  configured so that it's in the same wheel group and can sudo without
>  a password? 
The fedora user is created by cloud init, and that creates
/etc/sudoers.d/90-cloud-init-users, which looks like this:

  # Created by cloud-init v. 0.7.9 on Sun, 10 Dec 2017 20:17:02 +0000
  
  # User rules for fedora
  fedora ALL=(ALL) NOPASSWD:ALL

Look at /etc/cloud/cloud.cfg for where this comes from. You can
override this with your new user information when you provision the
instance.


-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader