知乎專欄 | 多維度架構 | 微信號 netkiller-ebook | QQ群:128659835 請註明“讀者” |
debian:~# apt-get install sudo
sudo的配置檔案是/etc/sudoers,visudo修改時會鎖住sudoers檔案,保存修改到臨時檔案,然後檢查檔案格式,確保正確後才會覆蓋sudoers檔案. 必須保證sudoers格式正確,否則sudo將無法運行.
/etc/sudoers
# /etc/sudoers # # This file MUST be edited with the 'visudo' command as root. # # See the man page for details on how to write a sudoers file. # Defaults env_reset # Host alias specification # User alias specification # Cmnd alias specification # User privilege specification root ALL=(ALL) ALL # Uncomment to allow members of group sudo to not need a password # (Note that later entries override this, so you might need to move # it further down) %sudo ALL=NOPASSWD: ALL
sudo group
neo@debian:/etc/mysql$ cat /etc/group | grep 'sudo' sudo:x:27:neo
visudo調用的預設編輯器是vi,如果要臨時使用其他編輯器,在該命令前加上EDITOR環境變數即可.
[root@netkiller ~]# EDITOR=vim visudo
>1 允許neo用戶從任何主機登錄,以root的身份執行/usr/sbin/useradd命令 neo ALL=(root) /usr/sbin/useradd >2 允許jam用戶從任何主機登錄,以root的身份無密碼使用sudo執行/sbin/iptables -n -t filter -L jam ALL=(ALL) NOPASSWD: /sbin/iptables -n -t filter -L >3 neo用戶從任何主機登錄,以root的身份執行自定義命令鏈裡面的命令 Cmnd_Alias USERCOMMAND = /sbin/route,/sbin/ifconfig,/bin/ping,/sbin/dhclient,/usr/bin/net,/sbin/iptables,/usr/bin/rfcomm,/usr/bin/wvdial,/sbin/iwconfig neo ALL=(root) USERCOMMAND
ubuntu NOPASSWD sudo的時候不需要輸入密碼
組
%admin ALL=(ALL)ALL 改為 %admin ALL=(ALL) NOPASSWD: NOPASSWD: ALL
用戶
www localhost=NOPASSWD: /bin/cat, /bin/ls
命令前面加‘!’可以禁止用戶運行該命令
neo ALL = (root) /bin/mount, /bin/umount, !/bin/mount /data0 dba ALL = /bin/mount /u0[1-5], /bin/umount /u0[1-5]
Cmnd_Alias 定義命令別名
Cmnd_Alias WEBMASTER = /srv/nginx/sbin/nginx, /srv/php/sbin/php-fpm, !/srv/mysql/bin/mysql www localhost = NETWORKING, SERVICES, DELEGATING, PROCESSES, WEBMASTER
自定義用戶組(以所有的身份)執行自定義的命令鏈裡的命令
Cmnd_Alias USERCOMMAND = /sbin/route,/sbin/ifconfig,/bin/ping,/usr/sbin/mtr,/bin/traceroute,/usr/bin/top,/bin/df,/usr/bin/free,/usr/bin/du,/bin/ls,/bin/date,/usr/bin/less User_Alias ADMINS = user1, user2 ADMINS ALL=(ALL) USERCOMMAND
## Allow root to run any commands anywhere root ALL=(ALL) ALL neo ALL=(ALL) ALL %wheel ALL=(ALL) ALL
將用戶加入到 wheel 組
[root@localhost ~]# usermod -aG wheel www