实验室网站建设的调查报告,海报设计图片手绘图,山东住房城乡建设厅官方网站,做任务挣钱的网站appsudo配置临时取得root权限系统中的普通用户有时需要root权限执行某种操作#xff0c;要是使用su - root的话必须要知道root的密码#xff0c;这是不安全的#xff0c;所以有了sudo#xff0c;root可以对/etc/sudoers做一定的配置#xff0c;让普通用户在不切换到root的情况…sudo配置临时取得root权限系统中的普通用户有时需要root权限执行某种操作要是使用su - root的话必须要知道root的密码这是不安全的所以有了sudoroot可以对/etc/sudoers做一定的配置让普通用户在不切换到root的情况下执行一些只有root才能执行的操作。这个文件只能root去修改建议使用visudo这个命令修改而不是直接vim /etc/sudoers。原因有二◦ 一是它能够防止两个用户同时修改它◦ 二是它也能进行有限的语法检查。当编辑这个文件有错误时使用visudo会给出错误提示此时可以按e重新编辑x不保存退出Q保存退出如果选择Qsudo就不能正常工作了。 实验过程完成了给指定用户sudo权限和用别名指定一组用户的可以执行的sudo指令 过程如下 [plain] view plaincopy [rootmail ~]# visudo #chen为普通用户ALL可以从任何的主机登陆(root)可以以root身份后面是可以执行的命令最好写全路径 88 ## Allow root to run any commands anywhere 89 root ALL(ALL) ALL 90 chen ALL(root) /usr/sbin/useradd,/usr/bin/passwd 91 ## Allows members of the sys group to run networking, software, [rootmail ~]# exit logout [chenmail 桌面]$ sudo -l #查看自己可以执行的sudo命令 [sudo] password for chen: #输入自己的密码 Matching Defaults entries for chen on this host: requiretty, always_set_home, env_reset, env_keepCOLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS, env_keepMAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE, env_keepLC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES, env_keepLC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE, env_keepLC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY, secure_path/sbin\:/bin\:/usr/sbin\:/usr/bin User chen may run the following commands on this host: (root) /usr/sbin/useradd, (root) /usr/bin/passwd #这里看到可以执行的sudo命令 [chenmail 桌面]$ sudo useradd user3 #测试 [chenmail 桌面]$ sudo passwd user3 更改用户 user3 的密码 。 新的 密码 无效的密码 过短 无效的密码 过于简单 重新输入新的 密码 passwd 所有的身份验证令牌已经成功更新。 [chenmail 桌面]$ id user3 #添加user3成功 uid503(user3) gid503(user3) 组503(user3) [chenmail 桌面]$ visudo #普通用户不允许编辑 visudo: /etc/sudoers: Permission denied visudo: /etc/sudoers: Permission denied [chenmail 桌面]$ su - root 密码 [rootmail ~]# visudo [rootmail ~]# cat /etc/sudoers |grep user1 #编辑增加了下面一行 user1 ALL(user2) /bin/ls [rootmail ~]# su - user1 [user1mail ~]$ sudo -l We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for user1: Matching Defaults entries for user1 on this host: requiretty, always_set_home, env_reset, env_keepCOLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS, env_keepMAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE, env_keepLC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES, env_keepLC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE, env_keepLC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY, secure_path/sbin\:/bin\:/usr/sbin\:/usr/bin User user1 may run the following commands on this host: (user2) /bin/ls [user1mail ~]$ ls /home/user2 #user1直接查看user2的家目录肯定是不允许的 ls: 无法打开目录/home/user2: 权限不够 [user1mail ~]$ sudo -u user2 ls /home/user2 #但是sudo以user2的身份查看就可以 a #这里不能以user2的身份添加用户因为user2本身还没有useradd的权限 #事实上即使给user2 sudo的添加用户权限这样也是不行的因为user2添加的时候也要sudo的啊 #直接以user2肯定不行看演示。 [user1mail ~]$ sudo -u user2 useradd user4 #这时候不能添加 Sorry, user user1 is not allowed to execute /usr/sbin/useradd user4 as user2 on mail.example.com. [user1mail ~]$ exit logout [rootmail ~]# visudo #添加了这行给user2 sudo添加用户的权限这时候sudo -u user2 useradd user4是否可以呢不行的 user2 ALL(root) /usr/sbin/useradd,/usr/bin/passwd [rootmail ~]# su - user2 [user2mail ~]$ sudo -l We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for user2: Matching Defaults entries for user2 on this host: requiretty, always_set_home, env_reset, env_keepCOLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS, env_keepMAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE, env_keepLC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES, env_keepLC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE, env_keepLC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY, secure_path/sbin\:/bin\:/usr/sbin\:/usr/bin User user2 may run the following commands on this host: (root) /usr/sbin/useradd, (root) /usr/bin/passwd [user2mail ~]$ su - user1 密码 [user1mail ~]$ sudo -u user2 useradd user4 #答案在此不行的 Sorry, user user1 is not allowed to execute /usr/sbin/useradd user4 as user2 on mail.example.com. [user1mail ~]$ #总结下sudo -u 用户名 命令 当前用户以某个用户的身份执行某个命令的时候必须这个用户本身不加sudo的情况 #直接能执行的命令才可以这种方式执行。另外sudo不加-u默认以root身份执行 [user1mail ~]$ exit logout [user2mail ~]$ exit logout [rootmail ~]# visudo #改动如下删除了9192行 88 ## Allow root to run any commands anywhere 89 root ALL(ALL) ALL 90 chen ALL(root) /usr/sbin/useradd,/usr/bin/passwd 91 user1 ALL(user2) /bin/ls #删除 92 user2 ALL(root) /usr/sbin/useradd,/usr/bin/passwd #删除 88 ## Allow root to run any commands anywhere 89 root ALL(ALL) ALL 90 chen ALL(root) /usr/sbin/useradd,/usr/bin/passwd 91 ADMIN ALL(root) /usr/sbin/useradd,/usr/bin/passwd #新添加 20 # User_Alias ADMINS jsmith, mikem 21 User_Alias ADMIN user1, user2 #新添加 22 #这里相当于ADMIN为user1user2的别名这个别名具有添加用户的权限user1和user2也具有这个权限 [rootmail ~]# su - user1 [user1mail ~]$ sudo -l [sudo] password for user1: Matching Defaults entries for user1 on this host: requiretty, always_set_home, env_reset, env_keepCOLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS, env_keepMAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE, env_keepLC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES, env_keepLC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE, env_keepLC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY, secure_path/sbin\:/bin\:/usr/sbin\:/usr/bin User user1 may run the following commands on this host: (root) /usr/sbin/useradd, (root) /usr/bin/passwd #可以看到user1有useradd权限 [user1mail ~]$ su - user2 密码 [user2mail ~]$ sudo -l [sudo] password for user2: Matching Defaults entries for user2 on this host: requiretty, always_set_home, env_reset, env_keepCOLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS, env_keepMAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE, env_keepLC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES, env_keepLC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE, env_keepLC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY, secure_path/sbin\:/bin\:/usr/sbin\:/usr/bin User user2 may run the following commands on this host: (root) /usr/sbin/useradd, (root) /usr/bin/passwd #user2也有 [user2mail ~]$ 转载于:https://www.cnblogs.com/exmyth/p/9074718.html
