RIP Sudo, Open Doas Is My New Best Friend

Like everyone else on Linux I've been using sudo but when I tried out doas on my gentoo install I really liked it so I thought why not try it out over on my main Arch install and I've really been liking it.
==========Support The Channel==========
► $100 Linode Credit: brodierobertson.xyz/linode
► Patreon: brodierobertson.xyz/patreon
► Paypal: brodierobertson.xyz/paypal
► Liberachat: brodierobertson.xyz/liberachat
► Amazon USA: brodierobertson.xyz/amazonusa
==========Resources==========
Sudo Website: www.sudo.ws/sudo.html
Open Doas GitHub: github.com/Duncaen/OpenDoas
Doas Edit Github: github.com/AN3223/scripts/blo...
=========Video Platforms==========
🎥 Odysee: brodierobertson.xyz/odysee
🎥 Podcast: techovertea.xyz/youtube
🎮 Gaming: brodierobertson.xyz/youtube
==========Social Media==========
🎤 Discord: brodierobertson.xyz/discord
🎤 Matrix Space: brodierobertson.xyz/matrix
🐦 Twitter: brodierobertson.xyz/twitter
🌐 Mastodon: brodierobertson.xyz/mastodon
🖥️ GitHub: brodierobertson.xyz/github
==========Time Stamps==========
0:00 Introduction
1:34 Why Use Doas
2:49 Setting Up Doas
5:36 Configuring Doas
8:02 Syntax Checker
8:47 Doasedit
9:59 Persisting The Password
10:41 Fixing Arch Linux
13:28 Outro
==========Credits==========
🎨 Channel Art:
All my art has was created by Supercozman
/ supercozman
/ supercozman_draws
#Linux #Sudo #Doas
🎵 Ending music
Music from filmmusic.io
"Basic Implosion" by Kevin MacLeod (incompetech.com)
License: CC BY (creativecommons.org/licenses/b...)
DISCLOSURE: Wherever possible I use referral links, which means if you click one of the links in this video or description and make a purchase I may receive a small commission or other compensation.

[@voxelfusion9894]

That cursed toast stares into my soul.

[@BrodieRobertson]

As it should

[@drgr33nUK]

Sums up Arch nicely. Arch is dependent on sudo but sudo isn't included in the base package last time I checked :)

[@BrodieRobertson]

I did make 1 slight mistake, the hardcoded sudo problem was fixed but it looked as if it wasn't inside of the bug tracker. That's my bad but it did take an incredibly long time to get fixed and I don't take back that it was awfully designed. However creating the symlink is still important for other programs with the exact same problem

[@BrodieRobertson]

@lain. yes

[@s9209122222]

Like what programs? I hope that I don't need them...

[@franklemanschik_de]

lol freaking ideas this guys got doas sudo the name and implementation does not matter if you want to run commands as a user simply login that user that can be done via systemd if you do not use systemd then you already know what to do as you did implement a whole sysV init implementation :)

[@fossware]

Next vid: RIP SoyStemD, I’m switching to Artix.

[@BrodieRobertson]

My system is already booted by the time I climb out of bed

[@waldolemmer]

@@BrodieRobertson So you're saying the init system doesn't matter once the boot process is done?

[@terrydaktyllus1320]

@@BrodieRobertson That's true for openrc in Gentoo too. I would suggest that's more to do with having an SSD as your primary OS drive more than anything else.

[@terrydaktyllus1320]

@@waldolemmer It purely depends on the distro you use and, if you're building your own, what your preference is. You still need an init system after boot up in case you want to change what services are started on boot and in case you want to restart a service after changing its configuration. Systemd is extremely "monolithic" and many people don't like it (myself included) because it doesn't follow the UNIX philosophy of "keep it simple and just have any application do one job but do it well". At home I use Gentoo which uses the more "traditional" init system under openrc - but I also work on Red Hat servers and those use systemd. So, in my case, I have to know a bit of both.

[@AZAD_420]

i use artix btw

[@singletona082]

Honestly I could see doas being helpful if you've got specific accounts for specific needs. like you're SSH'd into a server and you're logged in to check on the tuxcart server, but another userspace on that server is dedicated to your webserver, or whatever you can use doas to check on that from the same session.

[@Vaughanflaherty]

Join us… join the doas club

[@AnzanHoshinRoshi]

tyb. I'm going to reread the man for sudo. I use it for a few things but I'll need to see what I'm missing.

[@eurimontero1883]

Thank you so much, really, thank you 💓💓

[@ImageJPEG]

As a FreeBSD user, I always roll my eyes whenever I see sudo being a dependency, like Veracrypt.

[@taidee]

Well, you haven't sold this one to me successfully. I don't hate the attempt so of course I give it a like.

[@nycbearff]

Thanks, I switched over to doas. It works perfectly well for my needs, and I dislike executing 220,000 lines of code to do something this simple.

[@jeremyandrews3292]

I was actually expecting the difference to be the opposite... that is, doas would be the one that could do a lot more than sudo, maybe would potentially let you mess with group membership and run things as different users. I was surprised that anyone would would actually WANT a more limited program that couldn't do as much. Now that I know sudo can do everything I would ever have wanted it to be capable of, though, I'm probably going to read over the manpage and look into making use of that extra functionality now that I know it's there waiting to be used.

[@sagichdirdochnicht4653]

Well, I'm no expert, but as far as I can research, sudo is much more insecure, because it is so massive and has so many options. That's why you may want to switch to doas. If you fear, that you are loosing functionality... If you are a desktop linux user - yeah sure, as if you were to ever use those functions, lol. Don't shit yourself. I suppose I'm not a real "power user", but you may imagine I've typed in "sudo" at least a couple thousand times, as I'm using linux for over a decade at this point. I can assure you that I have NEVER used a flag, an argument or whatever feautres sudo might bring. All I need - and most likely all you ever need - is to run a command with root privileges. And that's exactly what doas does.

[@marcusmeaney]

this is exactly the kind of program you want as small as possible, its a crucial system piece with a large surface area for vulnerabilities. the majority of people only use sudo for running a command as root. its better to have a program specifically tailored to doing that, than a huge moving piece that you don't use 99% of. it also does come with letting you run things as different users

[@killistan]

Ha! you finally came around ;)

[@AgapitoHampaslupa12]

Does doas have a feature similar to sudo askpass?

[@wyfyj]

I might put it on my Gentoo system tomorrow.

[@TheBlueThird]

Debian and Ubuntu both have doas packages.

[@Speykious]

If I ever switch to Void, I'm gonna use doas.

[@unpotatoedsalmon]

2 years later have you switched to void

[@thepaulcraft957]

sudo constantly breaks on my fresh arch install, so I wanna use doas, thx!

[@knghtbrd]

doas (6.8.1-2) is available in Debian bullseye, with a -3 in Ubuntu jammy and it's been in Debian since January 21. This wasn't opendoas-that came later. It's in Debian testing and sid, and Ubuntu kinetic's got it. Differences between BSD doas and opendoas are very minimal. An extra convenience CLI argument as I recall and a little better documentation.

[@YannMetalhead]

Good video.

[@ashishpatel350]

Doas masta race !

[@Volian0]

I'd use doas if it didn't have a serious issue: for some reason it sets all locale variables to "POSIX" and my keyboard layout doesn't work correctly (this problem doesn't happen with sudo)

[@Chonny_Boy]

To get around your issue you can do the following: permit persist keepenv setenv { XAUTHORITY LANG LC_ALL } :wheel

[@johnrambo4158]

Please make a video on how to make an askpass for doas. :)

[@angelplayz5783]

Well, if nothing else, I guess it's good to see an alternative but I'm personally sticking with sudo until and if it breaks something. I have outgrown some exploration phases in Linux and I am now moving solely towards stability and reliability when it comes to my Linux builds. Still, always good to see something new, my friend. Keep up the good work. 👍

[@N0zer0]

Bash completion for pacman package names doesn't work with doas only with sudo.

[@Chonny_Boy]

in your .bashrc file add the following: complete -cf doas

[@N0zer0]

@@Chonny_Boy Thank you, it works now. I didn't know this command exists and it's this useful.

[@sad0n3]

Uff! Pacman the best

[@mrcrackerist]

Never need to configure paru to use doas after using the softlink method

[@gx1tar1er]

I've tried doas before but i've decided to stick with sudo. The same reason i stick with the stock kernal.

[@andljoy]

Its not that i hate sudo , its just that its not necessary in a shared system i can see it being usefull , for your own PC , not needed use doas .

[@AdriaanZwemer]

as a windows user, i would definitely have just made a symlink as well lol

[@zionlee1004]

Debian has doas. Ive always used doas in debian. Debian doesnt even install sudo unlike unbuntu does.

[@TheBlueThird]

That always puzzled me by why Debian did that.

[@mountaingiant6564]

If my distribution don`t use sudo is there any point to installing this program?

[@BrodieRobertson]

What distro doesn't ship sudo?

[@utilitymuffin.]

@@BrodieRobertson arch lol

[@BrodieRobertson]

@@utilitymuffin. It comes from base-devel which you should be installing if you want basic system utils

[@terrydaktyllus1320]

It all comes down to how much you trust yourself using "su" as the alternative way of doing things as root.

[@linuxramblingproductions8554]

@@BrodieRobertson gentoo doesn’t

[@mrsansiverius2083]

Next up: getting rid of systemd

[@armynyus9123]

Rite... and then build something declarative on top of runit, so that starter files can be synthesized and parsed programaticaly. Keys and allowed values we could steal from systemd... And while we are at it, add system and user mode and something which spawns filesystem containers, from init - not user, so that it is portable, means we need a client, a bus and a server on top of init. Sth like systemd-nspawn. But faaar more light weight.. ;-)

[@BrodieRobertson]

No point for me really

[@someonestolemyname]

@@BrodieRobertson No point but I guess it won't hurt? Using Artix but with GUI image and seldom touch low level stuff.

[@mrfluffy9273]

Getting rid is systemd doesn't mean anything except gives you that bragging rights. Honestly systemd is an amazing peace of software pipes are just amazing. With all that said I use artix with openrc BTW

[@someonestolemyname]

@@mrfluffy9273 Well yeah, I just use Artix because I don't want to set up LXQt myself.

[@riseabove3082]

doas is available in Ubuntu (doas/jammy 6.8.1-3 amd64 - minimal replacement for sudo). I still don't see a real good reason to use it over sudo. Is it really worth all the trouble? Not to me. I use a function alias in my bash profile to determine when to use sudo and not to use it so I don't have to remember. Good enough for me.

[@snipzmattio5887]

Im slowly turning my linux system into a bsd lol. First doas then xbps

[@snipzmattio5887]

@pengav true hahaha, i tried ksh once but i didnt figure out how to customize it i just gave up (was midnight)

[@tunahankaratay1523]

@pengav ksh feels a bit barebones compared to bash or anything modern. csh and tcsh are interesting but posix/bourne shell are the standard, so I stick with it. They also feel more barebones just like ksh.

[@squ34ky]

Friendship ended with _sudo._

[@BrodieRobertson]

Embrace the meme

[@nevoyu]

On Gentoo I don't install doas or even sudo.

[@BrodieRobertson]

Do you just use su?

[@magnusanderson6681]

@@BrodieRobertson Imagine not just running everything including your web browser as root 🤡

[@terrydaktyllus1320]

@@BrodieRobertson As a fellow Gentoo user, "yes" is the answer. I do install sudo in Gentoo simply because I work on Red Hat systems in my day job and Red Hat is very reliant on it - so I keep it around just to test certain settings that may have to go into a customer's system. Most of the time in Gentoo, I just use su for as long as I need it for, then come out of it when done.

[@namesame]

Is that Jesus? Which painting is it?

[@lokithedark1]

why run sudo pacman -Syu when you could run sudo doas su && pacman -Syu && exit

[@stizaidtl2146]

That wouldn't work, you have to write it as sudo doas su -c 'pacman -Syu && exit'

[@dulanjala]

I have no problems with sudo... no need for replacement...

[@jonathandawson3091]

Yeah, it sounded like a fad to me.

[@__-kd8oz]

su -c "command"

[@michaelheimbrand5424]

Doas comes from OpenBSD. There is no better proof of quality. Compared to the stuff OpenBSD does, everything else is to be seen as alpha software.

[@francescovolpini]

>openssl

[@killistan]

I want OpenBSD's ifconfig on Linux.

[@tunahankaratay1523]

OpenBSD needs two things. More developers, and a filesystem from 90s. Seriously, the filesystem options make it just impossible to use for storage server applications. FreeBSD is less FOSS than many Linux distros (Gentoo, Artix, Void etc.), so I don't want to use it. OpenBSD with ZFS or even an ordinary journaling filesystem would be astonishing.

[@francescovolpini]

@@tunahankaratay1523 what do you mean by "less foss"?

[@killistan]

@@tunahankaratay1523 Yeah my OpenBSD-as-main experience involved a mid 2000s laptop with a bad battery. I'd never seen anything show up in lost+found before that... a journaled filesystem would be appreciated.

[@elzabethtatcher9570]

Strange that doas has no config by default. Not very intuitive. Is there any strong reason for such behavior?

[@nizzuta2611]

Probably for security, you don't want to give root access to anyone without the user specifying it. sudo neither gives you root access by default, but most distros just edit the config automatically. (Also I don't think being intuitive is a priority for doas as generally only an advanced user would be trying to change their privilege escalation program)

[@dremoralord6730]

Switching to doas gave me 300% more FPS!

[@terrydaktyllus1320]

300% could just mean increasing from 1 FPS to 3 FPS - which wouldn't be particularly impressive.

[@rogo7330]

Your programs should never ask user to elevate privileges. Setup new user with specific priviliges, run daemon with needed capabilities (to bind on ports less than 1024, for example) and work from that. You editing your system? Go and login as root or just `su -` or `doas /bin/bash`.

[@drishalballaney6590]

alias sudo="doas" cause why not :P

[@terrydaktyllus1320]

Because if you work on anyone else's system, that alias probably won't be there and you'll just end up running sudo anyway. If you work across multiple systems, some of which may be owned by a client or customer, then you are far better off minimising the use of aliases and shortcut keys so that you don't slip into trying to use them when you're not on your own systems.

[@linuxramblingproductions8554]

@@terrydaktyllus1320 most systems that your working with outside of your own are far more likely to be using sudo then doas so no

[@terrydaktyllus1320]

@@linuxramblingproductions8554 Yes, I just said that. Are you a parrot?

[@linuxramblingproductions8554]

@@terrydaktyllus1320 I misunderstood i thought you were suggesting to go ahead and run doas since that wouldn’t on other machines

[@terrydaktyllus1320]

@@linuxramblingproductions8554 I have no idea whether doas works or not - I do not use it. I make life as easy as possible for myself - sudo is available on all Linux machines and I know it well enough to configure it as I need to. There is no point my learning doas for that reason.

[@jonathandawson3091]

Sounded like a fad to me.

[@jonathandawson3091]

If you thought the makepkg developer is an absolute idiot for hard coding sudo, you could have offered to send in a patch. Also patch everything else that's hard coded will you? Like echo, cd, mkdir - you know - there may be alternative ways to do them to right?

[@alerikaisattera1465]

Brodie defiantly refuses to acknowledge that not all software are applications

[@BrodieRobertson]

ln -s software application

[@alerikaisattera1465]

@@BrodieRobertson just because you think that all software are applications does not mean that's actually true

[@Mpdarkguy]

@@alerikaisattera1465 what is software without an application if not useless? They're called applications because they have a purpose: us interacting with them.

[@alerikaisattera1465]

@@Mpdarkguy no, applications are a specific type of software. Just because a user interacts with the software does not mean that it is an application

[@terrydaktyllus1320]

@@alerikaisattera1465 Absolutely it does. Any piece of data sat on storage media is only a collection of bytes of data until you open an application to do something with it - vim on a text file, GIMP on a JPG image, Excel on an XLS spreadsheet or workbook. If you want to be pedantic then you could (technically) edit a file by changing the right bytes in the right place in the raw file sat on the hard disk - but you still need a hex editor (application) or use some commands (applications) in the Linux shell (application) to do it.

[@tigrankhachaturian8983]

I know one thing- if you do install doas, you're wasting your time completely. there is no benefit of using it unless you're sisadmin. All the commands, scripts and shit are written with sudo in mind

[@MasterHigure]

I just sat down to start using doas on my home pc, and used this video as a guide. I couldn't get the groups thing in the config to work, so I had to use my username instead. That took some figuring out. Also, I had to fix the doasedit script to use my neovim rather than vim. I did that by changing the line ${EDITOR:-vi} "$tmp" to ${EDITOR:-nvim} "$tmp" Also I had to make my neovim visible to the system as an editor in the first place, as it wasn't in my update-alternatives. Ubuntu is not keeping neovim updated in their repos, so I just download the appimage, and that doesn't get installed into the system in the same way that it would be from apt. Up until now I have just had an alias for it, but that won't cut it here, as sudo, sudoedit, doas and doasedit don't look at aliases that way. So now I have a proper symlink in my $PATH to my appimage, and update-alternatives has been told to prioritize neovim over vim, nano, and ed. So that was fun little truobleshooting exercise, constantly swapping between sudo and doas as I messed with the settings, but it worked out in the end (I bet my Fish predictive command guesser is going to be proper confused for a while ^^). This video got me through the basics of it, even if I did have to hack a little myself. So thank you. I don't think I will be uninstalling sudo, however. The moment I mess up my doas config it would be a mess to not have sudo and instead rely on su or similar.

[@terrydaktyllus1320]

More software for the "fashionistas" and "cool kids"... I don't know how many times I need to repeat this as an old bloke who started using Linux in 1996 (and UNIX about 10 years before that), has made Gentoo Linux his main OS since 2003 and has worked full time on Red Hat Enterprise Linux servers (installing, configuring, hardening and debugging/fault finding on them) for more than 20 years now. Linux skills are VERY marketable. Windows admins are "two a penny" but if you can develop your Linux skills on your own and in the background and throw together a few shell scripts that do interesting things, it looks very good on a CV/resume. What you do on your own Linux systems at home is, of course, your own business BUT if you want to go work in Linux you are not going to find the "fashionista" tools like zsh and fish shells, doas, not a lot of emacs and a number of other "modern" applications on systems being run by your clients and customers, whose systems you are going to need to look after. High availability server environments do not allow anyone to come in and install their own stuff just to have their working environment - the best you might be allowed to do is upload your own .bashrc or .bash_profile into your user account on the systems. Therefore, if you do want that Linux career, learn the "boring" applications and learn them well - vim, sed, awk, sudo, netstat, nmap, etc. etc. - because those are the tools that are pretty much always going to find on any system that you log into. Plus any scripts you write using those kinds of tools become very portable across multiple systems. Why learn multiple tools that do the same job? It simply "thinking like an engineer" and saving yourself a lot of time and effort. Take it from an old bloke.

[@BrodieRobertson]

doas isn't some crazy fancy tool, it's the standard on OpenBSD, but besides that not everyone who is using Linux is doing so eith the aim of finding a career, some people just like the system or want to contribute to open source projects.

[@terrydaktyllus1320]

@@BrodieRobertson Correct, but I am not addressing the people who use FreeBSD or those who aren't planning a career in Linux - but I would suggest that if you're not long out of a university degree, using Linux now and liking it, then I doubt many of you would turn away a well-paid job offer with Linux. In which case the advice from an old "been there, done that" codger (who is still learning, even from "mere saplings" like yourself) may be of some use to others. I am lazy but I also take pride in my abilities and reputation in front of customers and clients - therefore, any shortcuts I can take that don't impact either of the above, I will take them. That includes using a "learn once, use often" philosophy as much as possible. Less tools = more beer time.

[@krzychhoo]

The thing with sudo is that a regular home user doesn't use all of those features anyways, meaning they aren't learning them. They have to go out of their way to even care about them.

[@terrydaktyllus1320]

@@krzychhoo I don't use all of the different settings on my power drill. It's still an extremely useful tool though. What is your point here precisely? Why would you learn a "lower quality tool" just because you don't use all of the features in it but the entire rest of the commercial world runs distros that use sudo by default - so by learning sudo at home, you can automatically use that knowledge on other Linux systems. Is it simply because you don't want to admit to being a "software fashionista" that needs to run something completely obscure just to look "l33t" in front of his peers?

[@krzychhoo]

@@terrydaktyllus1320 The main advantage doas has for a home user is less potential bugs and possible exploits by simply having less code. Nobody is going to hack your drill, so comparing that to this situation is pointless. Doas is not a lower quality tool for 99% of home users. It's the other way around. It has enough features but also benefits of a smaller codebase. A regular home user using sudo or doas has pretty much the same features they need, they don't learn all the obscure sudo features because(once again) they have absolutely 0 use for them on their home PC. Also as Brodie mentonied not everyone wants to become a sysadmin for a living. Calling me a software fashionista just makes you look even worse. I litteraly run Windows 10 on my main PC.