MidnightBSD: The BSD For Everyone

doas Configuration

doas Configuration

Introduction

doas is a utility for executing commands as another user, primarily designed as a simpler alternative to sudo. It is the default privilege escalation tool in MidnightBSD and is included in the base system. doas allows authorized users to run commands as root or other users without requiring the root password.

The doas command is particularly useful for system administration tasks where regular users need to perform specific administrative functions without full root access.

doas vs sudo

doas is the OpenBSD approach to privilege escalation and has several advantages over sudo:

• Simplicity - Minimal configuration with straightforward syntax
• Security - Smaller codebase means fewer potential vulnerabilities
• Default in base - Included with MidnightBSD, no need to install separately
• Cleaner syntax - More intuitive command structure

Unlike sudo, doas does not have extensive logging capabilities by default, but it provides the essential functionality needed for most use cases in a BSD environment.

Installation

doas is included in the MidnightBSD base system, so no additional installation is required. It is available as a command and does not require any service to be started.

To verify that doas is available:

$ which doas

This should return /usr/bin/doas.

If doas is not found, ensure that the base system is installed correctly. doas is part of the standard MidnightBSD installation.

Configuration File

The main configuration file for doas is /etc/doas.conf. If this file does not exist, you need to create it. The configuration file uses a simple syntax:

# permit|deny [options] identity [as targetuser] [cmd command [args...]]

Where:

• permit - Allows the specified action
• deny - Explicitly denies the specified action
• identity - The user or group who is allowed to execute the command
• targetuser - The user as whom the command may be executed. If as is omitted, the rule matches any target user; the doas command itself defaults to root unless -u is used.
• cmd - The command and arguments that are allowed

Create the configuration file if it doesn't exist:

# touch /etc/doas.conf

Always set secure permissions on the configuration file:

Basic Configuration Examples

Allow a specific user to run any command as root

To allow user john to run any command as root:

permit john as root

Allow a user to run specific commands

To allow user john to run only specific commands as root:

permit john as root cmd /usr/sbin/service
permit john as root cmd /sbin/ifconfig
permit john as root cmd /usr/sbin/mport

Allow a user to run commands without a password

By default, doas will prompt for the user's password. To allow a user to run commands without a password prompt:

permit nopass john as root cmd /usr/sbin/service

Allow a group to run commands

To allow all users in the wheel group to run any command as root:

permit :wheel as root

Allow specific commands with arguments

To allow user john to run service with specific arguments:

permit john as root cmd /usr/sbin/service args nginx start
permit john as root cmd /usr/sbin/service args nginx stop
permit john as root cmd /usr/sbin/service args nginx restart

Run commands as a different user

To allow user john to run commands as user backup:

permit john as backup cmd /usr/local/bin/rsync

Deny specific commands

You can explicitly deny certain commands even if other rules would permit them:

deny john as root cmd /sbin/shutdown

Advanced Usage

Using doas with specific environments

Use keepenv to preserve the caller's environment or setenv to retain only named variables. Preserve only variables required by the command:

permit keepenv john as root cmd /usr/bin/ee
permit setenv { TERM } john as root cmd /usr/sbin/mport

Argument matching

doas.conf does not use shell wildcards in command rules. Omitting args permits any arguments to that command; specify args to require an exact argument list:

permit john as root cmd /usr/sbin/service args nginx restart
permit john as root cmd /usr/sbin/mport args update

Multiple users and commands

Combine multiple rules for different users and commands:

permit john as root cmd /usr/sbin/service
permit john as root cmd /usr/sbin/mport
permit jane as root cmd /usr/local/bin/git
permit :wheel as root cmd /sbin/ifconfig

Testing configuration

Check the syntax before opening a separate session to test a permitted command:

# doas -C /etc/doas.conf
$ doas /usr/bin/whoami

Security Considerations

Always follow the principle of least privilege - only grant the minimum permissions necessary for users to perform their tasks.

• Be specific with commands - Avoid allowing users to run any command as root unless absolutely necessary
• Use command arguments carefully - Omitting an args restriction permits every argument list for that command
• Secure the configuration file - Ensure /etc/doas.conf is only readable and writable by root
• Monitor usage - Regularly review who has doas permissions and what they can execute
• Use groups wisely - Consider creating specific groups for administrative tasks rather than granting individual user permissions

Important security notes:

• If you permit users to run text editors like vi or ee as root, they may be able to edit system files and gain elevated privileges
• Avoid permitting shell access (sh, bash, tcsh) as root, as this effectively gives the user a root shell
• Be cautious with commands that can execute other commands (e.g., find -exec, xargs)

Troubleshooting

"doas: Operation not permitted"

This error typically occurs when:

• The user is not authorized in the doas.conf file
• The configuration file does not exist or has incorrect permissions
• Syntax error in the configuration file

Solution: Verify the configuration file exists, has correct permissions, and contains the appropriate rules.

"doas: No configuration file"

This indicates that doas cannot find its configuration file. Ensure that /etc/doas.conf exists.

"doas: permission denied"

This error can occur if the user's password is incorrect or if the command being attempted is not explicitly permitted.

Debugging configuration

You can test doas configuration by running commands as the target user:

$ su - john
$ doas whoami

Check that the configuration file syntax is correct and that the file permissions are set properly.

Verifying doas installation

If doas is not working at all, verify it's installed:

# which doas
# doas -C /etc/doas.conf
# man 1 doas