Root Access and sudo Configuration

Many operating systems (such as Ubuntu, Debian, Raspberry Pi OS, and SUSE Linux Enterprise 16) disable SSH access for the root user by default, or are installed without configuring a root password. To onboard these clients, you can use a regular, unprivileged user that has passwordless sudo privileges configured for the necessary Python and Salt minion binaries.

This configuration is required only for bootstrapping and registering the client. Once the client is successfully registered, the SUSE Multi-Linux Manager agent runs with root privileges, and this temporary passwordless sudo access is no longer required. For security reasons, we recommend removing these lines from the sudoers file after registration is complete.

1. Grant non-root user sudo access

To onboard a client using a non-root user, you must edit the sudoers file on the client system to grant passwordless privilege escalation for specific commands.

Procedure: Granting passwordless sudo access

  1. On the client, edit the sudoers file by running:

    sudo visudo

  2. At the end of the file, add the following line. Replace <user> with the name of the user that is bootstrapping the client:

    <user>  ALL=NOPASSWD: /var/tmp/venv-salt-minion/bin/python

For older operating systems (such as SUSE Linux Enterprise 15) using a legacy manual salt-minion registration setup instead of the default Salt Bundle, /usr/bin/python3 might still be required for privilege escalation:

+

<user>  ALL=NOPASSWD: /usr/bin/python3, /var/tmp/venv-salt-minion/bin/python

Self-installed versions of operating systems require passwordless privilege escalation because the Web UI and bootstrap scripts do not support interactive password entry during the privilege escalation step. For cloud instances, this is often handled automatically by cloud-init, which sets up sudoers configurations for default users.