# CVTSUDOERS(1) - man - phpman [CVTSUDOERS(1)](https://www.chedong.com/phpMan.php/man/CVTSUDOERS/1/markdown) BSD General Commands Manual [CVTSUDOERS(1)](https://www.chedong.com/phpMan.php/man/CVTSUDOERS/1/markdown) ## NAME **cvtsudoers** — convert between sudoers file formats ## SYNOPSIS **cvtsudoers** [**-ehMpV**] [**-b** _dn_] [**-c** _conf_file_] [**-d** _deftypes_] [**-f** _output_format_] [**-i** _input_format_] [**-I** _increment_] [**-l** _log_file_] [**-m** _filter_] [**-o** _output_file_] [**-O** _start_point_] [**-P** _padding_] [**-s** _sections_] [_input_file_ _..._] ## DESCRIPTION The **cvtsudoers** utility accepts one or more security policies in either _sudoers_ or LDIF format as input, and generates a single policy of the specified format as output. The default input format is _sudoers._ The default output format is LDIF. It is only possible to convert a policy file that is syntactically correct. If no _input_file_ is specified, or if it is ‘-’, the policy is read from the standard input. Input files may be optionally prefixed with a host name followed by a colon (‘:’) to make the policy rules specific to a host when merging multiple files. By default, the result is written to the standard output. The options are as follows: ### -b --base The base DN (distinguished name) that will be used when performing LDAP queries. Typically this is of the form ou=SUDOers,dc=my-domain,dc=com for the domain my-domain.com. If this option is not specified, the value of the SUDOERS_BASE en‐ vironment variable will be used instead. Only necessary when converting to LDIF format. ### -c --config Specify the path to the configuration file. Defaults to _/etc/cvtsudoers.conf_. ### -d --defaults Only convert Defaults entries of the specified types. One or more Defaults types may be specified, separated by a comma (‘,’). The supported types are: all All Defaults entries. global Global Defaults entries that are applied regardless of user, runas, host, or command. user Per-user Defaults entries. runas Per-runas user Defaults entries. host Per-host Defaults entries. command Per-command Defaults entries. See the **Defaults** section in [sudoers(5)](https://www.chedong.com/phpMan.php/man/sudoers/5/markdown) for more information. If the **-d** option is not specified, all Defaults entries will be converted. ### -e --expand-aliases Expand aliases in _input_file_. Aliases are preserved by default when the output _format_ is JSON or sudoers. ### -f --output-format Specify the output format (case-insensitive). The following formats are supported: CSV CSV (comma-separated value) files are often used by spreadsheets and re‐ port generators. For CSV output, **cvtsudoers** double quotes strings that contain commas. For each literal double quote character present inside the string, two double quotes are output. This method of quoting commas is compatible with most spreadsheet programs. JSON JSON (JavaScript Object Notation) files are usually easier for third- party applications to consume than the traditional _sudoers_ format. The various values have explicit types which removes much of the ambiguity of the _sudoers_ format. LDIF LDIF (LDAP Data Interchange Format) files can be imported into an LDAP server for use with [sudoers.ldap(5)](https://www.chedong.com/phpMan.php/man/sudoers.ldap/5/markdown). Conversion to LDIF has the following limitations: •• Command, host, runas, and user-specific Defaults lines cannot be translated as they don't have an equivalent in the sudoers LDAP schema. •• Command, host, runas, and user aliases are not supported by the sudo‐ ers LDAP schema so they are expanded during the conversion. sudoers Traditional sudoers format. A new sudoers file will be reconstructed from the parsed input file. Comments are not preserved and data from any include files will be output inline. **--group-file**=_file_ When the **-M** option is also specified, perform group queries using _file_ instead of the system group database. ### -h --help ### -i --input-format Specify the input format. The following formats are supported: LDIF LDIF (LDAP Data Interchange Format) files can be exported from an LDAP server to convert security policies used by [sudoers.ldap(5)](https://www.chedong.com/phpMan.php/man/sudoers.ldap/5/markdown). If a base DN (distinguished name) is specified, only sudoRole objects that match the base DN will be processed. Not all sudoOptions specified in a sudo‐ Role can be translated from LDIF to sudoers format. sudoers Traditional sudoers format. This is the default input format. ### -I --increment When generating LDIF output, increment each sudoOrder attribute by the specified number. Defaults to an increment of 1. ### -l --logfile Log conversion warnings to _log_file_ instead of to the standard error. This is par‐ ticularly useful when merging multiple _sudoers_ files, which can generate a large number of warnings. ### -m --match Only output rules that match the specified _filter_. A _filter_ expression is made up of one or more **key** **=** _value_ pairs, separated by a comma (‘,’). The **key** may be “cmnd” (or “cmd”), “host”, “group”, or “user”. For example, **user** = _operator_ or **host** = _www_. An upper-case Cmnd_Alias, Host_alias, or Host_Alias may be specified as the “cmnd”, “host”, or “user”. A matching _sudoers_ rule may also include users, groups, and hosts that are not part of the _filter_. This can happen when a rule includes multiple users, groups, or hosts. To prune out any non-matching user, group, or host from the rules, the **-p** option may be used. By default, the password and group databases are not consulted when matching against the filter so the users and groups do not need to be present on the local system (see the **-M** option). Only aliases that are referenced by the filtered pol‐ icy rules will be displayed. ### -M --match-local When the **-m** option is also specified, use password and group database information when matching users and groups in the filter. Only users and groups in the filter that exist on the local system will match, and a user's groups will automatically be added to the filter. If the **-M** is _not_ specified, users and groups in the filter do not need to exist on the local system, but all groups used for matching must be explicitly listed in the filter. ### -o --output Write the converted output to _output_file_. If no _output_file_ is specified, or if it is ‘-’, the converted _sudoers_ policy will be written to the standard output. ### -O --order-start When generating LDIF output, use the number specified by _start_point_ in the sudo‐ Order attribute of the first sudoRole object. Subsequent sudoRole object use a su‐ doOrder value generated by adding an _increment_, see the **-I** option for details. De‐ faults to a starting point of 1. A starting point of 0 will disable the generation of sudoOrder attributes in the resulting LDIF file. **--passwd-file**=_file_ When the **-M** option is also specified, perform passwd queries using _file_ instead of the system passwd database. ### -p --prune-matches When the **-m** option is also specified, **cvtsudoers** will prune out non-matching users, groups, and hosts from matching entries. ### -P --padding When generating LDIF output, construct the initial sudoOrder value by concatenating _order_start_ and _increment_, padding the _increment_ with zeros until it consists of _padding_ digits. For example, if _order_start_ is 1027, _padding_ is 3, and _increment_ is 1, the value of sudoOrder for the first entry will be 1027000, followed by 1027001, 1027002, etc. If the number of sudoRole entries is larger than the pad‐ ding would allow, **cvtsudoers** will exit with an error. By default, no padding is performed. ### -s --suppress Suppress the output of specific _sections_ of the security policy. One or more sec‐ tion names may be specified, separated by a comma (‘,’). The supported section name are: **defaults**, **aliases** and **privileges** (which may be shortened to **privs**). ### -V --version Print the **cvtsudoers** and _sudoers_ grammar versions and exit. ### Merging multiple files When multiple input files are specified, **cvtsudoers** will attempt to merge them into a single policy file. It is assumed that user and group names are consistent among the policy files to be merged. For example, user “bob” on one host is the same as user “bob” on another host. When merging policy files, it is possible to prefix the input file name with a host name, sepa‐ rated by a colon (‘:’). When the files are merged, the host name will be used to restrict the policy rules to that specific host where possible. The merging process is performed as follows: •• Each input file is parsed into internal sudoers data structures. •• Aliases are merged and renamed as necessary to avoid conflicts. In the event of a conflict, the first alias found is left as-is and subsequent aliases of the same name are renamed with a numeric suffix separated with a underscore (‘_’). For example, if there are two different aliases named SERVERS, the first will be left as-is and the second will be renamed SERVERS_1. References to the renamed alias are also updated in the policy file. Duplicate aliases (those with identical contents) are pruned. •• Defaults settings are merged and duplicates are removed. If there are conflicts in the De‐ faults settings, a warning is emitted for each conflict. If a host name is specified with the input file, **cvtsudoers** will change the global Defaults settings in that file to be host- specific. A warning is emitted for command, user, or runas-specific Defaults settings which cannot be made host-specific. •• Per-user rules are merged and duplicates are removed. If a host name is specified with the input file, **cvtsudoers** will change rules that specify a host name of ALL to the host name associated with the policy file being merged. The merging of rules is currently fairly sim‐ plistic but will be improved in a later release. It is possible to merge policy files with differing formats. ### The cvtsudoers.conf file Options in the form “keyword = value” may also be specified in a configuration file, _/etc/cvtsudoers.conf_ by default. The following keywords are recognized: **defaults** **=** _deftypes_ See the description of the **-d** command line option. **expand**___**aliases** **=** _yes_ | _no_ See the description of the **-e** command line option. **group**___**file** **=** _file_ See the description of the **--group-file** command line option. **input**___**format** **=** _ldif_ | _sudoers_ See the description of the **-i** command line option. **match** **=** _filter_ See the description of the **-m** command line option. **match**___**local** **=** _yes_ | _no_ See the description of the **-M** command line option. **order**___**increment** **=** _increment_ See the description of the **-I** command line option. **order**___**start** **=** _start_point_ See the description of the **-O** command line option. **output**___**format** **=** _csv_ | _json_ | _ldif_ | _sudoers_ See the description of the **-f** command line option. **padding** **=** _padding_ See the description of the **-P** command line option. **passwd**___**file** **=** _file_ See the description of the **--passwd-file** command line option. **prune**___**matches** **=** _yes_ | _no_ See the description of the **-p** command line option. **sudoers**___**base** **=** _dn_ See the description of the **-b** command line option. **suppress** **=** _sections_ See the description of the **-s** command line option. Options on the command line will override values from the configuration file. ## FILES /etc/cvtsudoers.conf default configuration for cvtsudoers ## EXAMPLES Convert _/etc/sudoers_ to LDIF (LDAP Data Interchange Format) where the _ldap.conf_ file uses a _sudoers_base_ of my-domain,dc=com, storing the result in _sudoers.ldif_: $ cvtsudoers -b ou=SUDOers,dc=my-domain,dc=com -o sudoers.ldif \ /etc/sudoers Convert _/etc/sudoers_ to JSON format, storing the result in _sudoers.json_: $ cvtsudoers -f json -o sudoers.json /etc/sudoers Parse _/etc/sudoers_ and display only rules that match user _ambrose_ on host _hastur_: $ cvtsudoers -f sudoers -m user=ambrose,host=hastur /etc/sudoers Same as above, but expand aliases and prune out any non-matching users and hosts from the ex‐ panded entries. $ cvtsudoers -ep -f sudoers -m user=ambrose,host=hastur /etc/sudoers Convert _sudoers.ldif_ from LDIF to traditional _sudoers_ format: $ cvtsudoers -i ldif -f sudoers -o sudoers.new sudoers.ldif Merge a global _sudoers_ file with two host-specific policy files from the hosts “xyzzy” and “plugh”: $ cvtsudoers -f sudoers -o sudoers.merged sudoers \ xyzzy:sudoers.xyzzy plugh:sudoers.plugh ## SEE ALSO [sudoers(5)](https://www.chedong.com/phpMan.php/man/sudoers/5/markdown), [sudoers.ldap(5)](https://www.chedong.com/phpMan.php/man/sudoers.ldap/5/markdown), [sudo(8)](https://www.chedong.com/phpMan.php/man/sudo/8/markdown) ## AUTHORS Many people have worked on **sudo** over the years; this version consists of code written primarily by: Todd C. Miller See the CONTRIBUTORS file in the **sudo** distribution () for an exhaustive list of people who have contributed to **sudo**. ## BUGS If you feel you have found a bug in **cvtsudoers**, please submit a bug report at ## SUPPORT Limited free support is available via the sudo-users mailing list, see to subscribe or search the archives. ## DISCLAIMER **cvtsudoers** is provided “AS IS” and any express or implied warranties, including, but not lim‐ ited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. See the LICENSE file distributed with **sudo** or for complete details. ## Sudo 1.9.9 January 19, 2022 Sudo 1.9.9