USAGE for gen_sudoers.sh v1.6.0:

gen_sudoers.sh {-full|-limited} [-y [-f]] [-L <log>] [-D]

or

gen_sudoers.sh [-h|-man]


DESCRIPTION:
	This script generates a sudoers file for the OS user that owns /p4/common,
	which must be the same user that the p4* services runs as under systemd,
	typically 'perforce'. The intent is to honor the principle of least
	privilege. The generated sudoers file grants the access to user commands
	reasonably needed for service management (e.g. service start/stop) and
	diagnostics (e.g. lslocks, lsof), but no more.

	By default, the sudoers file is generated for review.  If the '-y'
	option is specified, the newly generated files is installed as
	the live sudoers file by copying to /etc/sudoers.d/<OSUSER> and
	adjusting permissions to 0400.

	If '-full' (full sudo) is specified, a one-line sudoers file is
	generated that looks something like this:

	perforce ALL=(ALL) NOPASSWD: ALL

   Warning: Using '-full' does NOT honor the principle of least
   privilege, and thus grants full sudo. This is not recommended
   because it elevates access of remote super users.

	If '-limited' is specified, a limited sudoers file is generated
	granting only necessary access to the perforce user, and thus
	honoring the principle of least privilege.

	If the sudoers file already exits, it will not be updated unless
	'-f' (force) is provided.

	The limited sudoers option is recommended for production deployments.

   This script must be executed as the root user.

OPTIONS:
 -full
 	Specify '-full' to indicate that a sudoers file is to be generated
	granting full root access to the server machine.

	The '-full' or '-limited' option must be specified.

	This option is discouraged as it is not as secure as the
	'-limited' option.

 -limited
	Specify '-limited' to indicate that a sudoers file is to be
	generated granting limited access to the server machine.

	The '-full' or '-limited' option must be specified.

	This option is recommended for optimal security.

 -y	This is confirmation to install the generated sudoers as the live
	sudoers file.

 -f	Specify '-f' to overwrite an existing limited sudoers file,
	/etc/sudoers.d/<OSUSER>

 -L <log>
	Specify the path to a log file, or the special value 'off' to disable
	logging.  By default, all output (stdout and stderr) goes to:

	/root/gen_sudoers.<Datestamp>.log

	NOTE: This script is self-logging.  That is, output displayed on the screen
	is simultaneously captured in the log file.

 -D     Enable bash 'set -x' extreme debugging verbosity.

HELP OPTIONS:
 -h	Display short help message
 -man	Display man-style help message
	
EXAMPLES:
	EXAMPLE 1: Generate a limited sudoers file for review.

	cd /p4/sdp/Server/Unix/setup
	./gen_sudoers.sh -limited

	EXAMPLE 2: Generate a limited sudoers file and install it.

	cd /p4/sdp/Server/Unix/setup
	./gen_sudoers.sh -limited -y

	EXAMPLE 3: Generate a limited sudoers file and install it, replacing an
	existing one.

	cd /p4/sdp/Server/Unix/setup
	./gen_sudoers.sh -limited -f -y

	EXAMPLE 4: Generate a full sudoers file and install it, replacing an

	cd /p4/sdp/Server/Unix/setup
	./gen_sudoers.sh -full -f -y