MidnightBSD: The BSD For Everyone

doas Configuration

doas Configuration

Introduction

doas is a utility for executing commands as another user, primarily designed as a simpler alternative to sudo. It is the default privilege escalation tool in MidnightBSD and is included in the base system. doas allows authorized users to run commands as root or other users without requiring the root password.

The doas command is particularly useful for system administration tasks where regular users need to perform specific administrative functions without full root access.

doas vs sudo

doas is the OpenBSD approach to privilege escalation and has several advantages over sudo:

• Simplicity - Minimal configuration with straightforward syntax
• Security - Smaller codebase means fewer potential vulnerabilities
• Default in base - Included with MidnightBSD, no need to install separately
• Cleaner syntax - More intuitive command structure

Unlike sudo, doas does not have extensive logging capabilities by default, but it provides the essential functionality needed for most use cases in a BSD environment.

Installation

doas is included in the MidnightBSD base system, so no additional installation is required. It is available as a command and does not require any service to be started.

To verify that doas is available:

$ which doas

This should return /usr/bin/doas.

If doas is not found, ensure that the base system is installed correctly. doas is part of the standard MidnightBSD installation.

Configuration File

The main configuration file for doas is /etc/doas.conf. If this file does not exist, you need to create it. The configuration file uses a simple syntax:

# permit|deny [options] identity [as targetuser] [cmd command [args...]]

Where:

• permit - Allows the specified action
• deny - Explicitly denies the specified action
• identity - The user or group who is allowed to execute the command
• targetuser - The user as whom the command should be executed (defaults to root)
• cmd - The command and arguments that are allowed

Create the configuration file if it doesn't exist:

# touch /etc/doas.conf

Always set secure permissions on the configuration file:

Basic Configuration Examples

Allow a specific user to run any command as root

To allow user john to run any command as root:

permit john as root

Allow a user to run specific commands

To allow user john to run only specific commands as root:

permit john as root cmd service
permit john as root cmd ifconfig
permit john as root cmd mport

Allow a user to run commands without a password

By default, doas will prompt for the user's password. To allow a user to run commands without a password prompt:

permit nopass john as root cmd service

Allow a group to run commands

To allow all users in the wheel group to run any command as root:

permit :wheel as root

Allow specific commands with arguments

To allow user john to run service with specific arguments:

permit john as root cmd service args start
permit john as root cmd service args stop
permit john as root cmd service args restart

Run commands as a different user

To allow user john to run commands as user backup:

permit john as backup cmd rsync

Deny specific commands

You can explicitly deny certain commands even if other rules would permit them:

deny john as root cmd shutdown

Advanced Usage

Using doas with specific environments

You can preserve or modify the environment when using doas:

permit john as root cmd ee env HOME
permit john as root cmd mport env PATH

Wildcards in commands

Use wildcards to match multiple commands or paths:

permit john as root cmd service *
permit john as root cmd mport *

Multiple users and commands

Combine multiple rules for different users and commands:

permit john as root cmd service
permit john as root cmd mport
permit jane as root cmd git
permit :wheel as root cmd ifconfig

Testing configuration

After editing the configuration file, test it by having the user attempt to run a permitted command:

The command should execute if the configuration is correct.

Security Considerations

Always follow the principle of least privilege - only grant the minimum permissions necessary for users to perform their tasks.

• Be specific with commands - Avoid allowing users to run any command as root unless absolutely necessary
• Use command arguments carefully - Be aware that allowing commands with wildcards or without argument restrictions can be exploited
• Secure the configuration file - Ensure /etc/doas.conf is only readable and writable by root
• Monitor usage - Regularly review who has doas permissions and what they can execute
• Use groups wisely - Consider creating specific groups for administrative tasks rather than granting individual user permissions

Important security notes:

• If you permit users to run text editors like vi or ee as root, they may be able to edit system files and gain elevated privileges
• Avoid permitting shell access (sh, bash, tcsh) as root, as this effectively gives the user a root shell
• Be cautious with commands that can execute other commands (e.g., find -exec, xargs)

Troubleshooting

"doas: Operation not permitted"

This error typically occurs when:

• The user is not authorized in the doas.conf file
• The configuration file does not exist or has incorrect permissions
• Syntax error in the configuration file

Solution: Verify the configuration file exists, has correct permissions, and contains the appropriate rules.

"doas: No configuration file"

This indicates that doas cannot find its configuration file. Ensure that /etc/doas.conf exists.

"doas: permission denied"

This error can occur if the user's password is incorrect or if the command being attempted is not explicitly permitted.

Debugging configuration

You can test doas configuration by running commands as the target user:

$ su - john
$ doas whoami

Check that the configuration file syntax is correct and that the file permissions are set properly.

Verifying doas installation

If doas is not working at all, verify it's installed:

# which doas
# doas -V  # Check version