RCW-NixPriv | Sudo Privilege Delegation Manager

Why you'd use it

Hand-editing sudoers is where good admins get burned. This removes the sharp edges.

SAFE

You cannot lock yourself out

Nothing is written until visudo -cf accepts the syntax. A malformed rule is rejected before it ever touches the live file.

PROMPTS

Guided, not hand-typed

Who gets it, what they may run, as which account, with or without a password — answered one question at a time. Users and groups are read live from the host.

LEAST PRIV

Per-command delegation

Let someone restart nginx without handing them root. Ten ready-made task packs (services, logs, packages, network, users, Docker…) you can trim.

AUDIT

Risk scanner

Flags command lists that quietly allow a root shell — editors, find, interpreters, tar, dd, su, chmod.

ROLLBACK

Every change is snapshotted

The previous policy is copied to /var/backups/rcw-nixpriv before each apply. Restore any snapshot in one click.

CLEAN

Touches one file only

Everything lands in /etc/sudoers.d/rcw-nixpriv. Your main /etc/sudoers and other drop-ins are never modified.

Get started in four steps

Nothing to install on Windows, nothing to install on the server.

Download and run RCW-NixPriv.exe It is a single portable file. Keep it on a USB stick or your admin jump box.

Connect to host Address, SSH port, login user, then a password or private key. Your sudo password if the account needs one.

Grant sudo rights Answer the wizard. Review the exact sudoers line and its risk verdict before anything is staged.

Validate & Apply The file is syntax-checked, the old one is backed up, and the new policy goes live as root:root 0440.

What it writes

Readable, commented, and reversible — here is a real example the wizard produces.

# Managed by RCW-NixPriv - do not edit by hand

# --- Command aliases ---
Cmnd_Alias WEB_OPS = /usr/bin/systemctl restart nginx, /usr/sbin/nginx -t

# --- Defaults ---
Defaults log_input, log_output
Defaults timestamp_timeout=15

# --- Delegations ---
# TICKET-4471 web team
%webops ALL=(root) NOEXEC: WEB_OPS
deploybot ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp

Before you run it

⚠

Windows SmartScreen will warn you on first launch

The download is not code-signed, so Windows shows “Windows protected your PC”. Choose More info → Run anyway. Verify the SHA-256 above first if you want to be certain the file is intact. Some antivirus engines also flag single-file Python builds heuristically — that is a known false positive pattern for this packaging method.

🔒

Test on a non-production host first

This tool changes who can become root on your server. That deserves the same care as any other privileged change — try it on a lab VM, confirm the result with sudo -l -U username, then use it in anger.

Requirements & details

Windows	Windows 10 or 11, 64-bit. No installer, no Python, no dependencies.
Target server	OpenSSH, `sudo` with an `@includedir /etc/sudoers.d` line (default on Debian, Ubuntu, RHEL, Rocky, Alma, SUSE, Amazon Linux) and an account that can reach root.
Authentication	Password or private key — RSA, Ed25519, ECDSA, DSA. Custom SSH port supported.
Stored on your PC	Host and user name only, in `%APPDATA%\RCW-NixPriv\profiles.json`. Passwords are never saved.
Version	1.0.0
Licence	MIT — free to use, including at work.