sudo & Privilege Escalation

After one successful sudo, you run several more sudo commands in a row and only the first asked for a password. What controls that window?

You run su to a user in a terminal, then type exit when done. Whose password does su prompt for, and how do you get back?

Someone runs su root, becomes root, but finds admin commands in /usr/sbin fail with command not found. What did they forget?

On a server with several admins, why is sudo preferred over sharing the root password, and whose password does each admin type?

sudo ls /etc > /etc/out.txt fails with a permission error even though sudo can read /etc. Why, and how do you fix it?

For a long series of admin commands, what does sudo -s give you over prefixing sudo to each one, and how do you leave it?

On a default Ubuntu system, someone tries to log in as root, then su -l root, then ssh -l root — all fail. Why, and what is the only way in?

On Fedora or RHEL, which group makes a user an administrator, and how does its root setup differ from Ubuntu's?

On openSUSE, sudo asks for the root password instead of your own by default. Which setting causes this, and what advantage does it defeat?

What is PolicyKit's core design idea for privileged desktop programs, and what does it gain over running the whole program as root?

pkexec nano works in a terminal, but pkexec gnome-text-editor fails with cannot open display. What extra setup does the graphical case need?

In Ubuntu's default /etc/sudoers, what do the three Defaults lines env_reset, mail_badpass, and secure_path each do?

On Ubuntu, root has no password — so which group membership actually lets an account run sudo, and who is in it?

On a fresh Raspberry Pi OS setup, why can the first user run any sudo command without a password, and how do you tighten it without breaking sudo?

On Debian, sudo is installed but sometimes inactive. What makes the difference, and how do you get root when it's inactive?

sudo nautilus launches the file manager fine on one machine but does nothing on another. What Wayland-related flag fixes it?

visudo insists on opening vi and you want a different editor. How do you change it?

PolicyKit has to decide whether a privileged mechanism may run. What information does it weigh, and how do the two program parts talk?

In the sudoers line catherine ALL=(ALL) /usr/sbin/parted, what do the two ALL fields mean?

Why should you never open /etc/sudoers in a plain text editor, and what do you use instead?

In sudoers, what does a % prefix on the first column do, and what does the NOPASSWD: tag change?

Why can an ordinary user not run many admin tasks, even for programs they can see in /usr/sbin?

Your security team wants an audit trail of who ran what as root. What does sudo record on its own?

sudo runs a command as root by default. How do you make it run as some other account instead, say to test something as user peter?

You add a NOPASSWD line for maria, but sudo still demands her password. What subtle rule did you hit?

You need to change how PolicyKit authorizes something. Which three locations hold its configuration, and what does each hold?

On a brand-new EC2 instance, sudo -s makes you root without any password. Why, and how do you lock it down?