What does /etc/sudoers control, why edit it only with visudo, and why manage sudo rules centrally in AD?

/etc/sudoers defines which users and groups may run which commands as root; visudo checks the syntax before saving, and keeping the rules in AD gives one place to manage them for all hosts.

A rule says: who, on which host, as which user, may run which command, for example %webdevs lc-001 = (root) /bin/systemctl restart apache2.

Why visudo: a syntax error in sudoers makes sudo refuse to work at all. On a system without a root password, that locks every admin out. visudo locks the file, opens a temporary copy, and only saves it if the syntax is valid.

Why store the rules in AD:

• One place: rules are not copied by hand to every Linux host and do not drift apart.
• Syntax enforced by the schema: each rule is an object with typed attributes, so a broken rule cannot break sudo.
• Efficient: sudo makes only two or three directory queries per call instead of parsing a large local file.
• Tied to identity: sudo rights follow AD group membership, like everything else in IAM.

Go deeper:

• sudo.ws: sudoers manual — the rule syntax: users, hosts, run-as and commands.
• sudo.ws: visudo manual — the locking and syntax check before saving.