给用户添加管理员使用命令的权限

时间:2024-02-21 16:14:05

sudo命令:
可以以最小化的权限(单个命令),执行命令时拥有root用户的权限

SUID 针对命令,任何用户执行命令都有root身份。 任何用户执行某个命令:模糊
SUDO 针对用户,给某个用户以root身份执行某个命令。指定用户执行某个命令:具体。


如何编辑配置sudo?

sudo是一个提权的命令(对应权限通过读取/etc/sudoers(严格语法)文件实现的)

配置/etc/sudoers可以使用visudo命令,或vim /etc/sudoers(不推荐)


[oldboy@oldboyedu ~]$ ls /root
ls: cannot open directory /root: Permission denied
完成上面的动作。

给oldboy用户,针对ls设置权限。

visudo进入编辑状态,100G

## Allow root to run any commands anywhere
root ALL=(ALL) ALL
oldboy ALL=(ALL) /usr/bin/ls,/bin/cp #<===增加一行
用户 主机=(角色) 命令

注意:
1、路径要全路径:
which cp查
2、不要vim /etc/sudoers编辑,如果非要用编辑完visudo -c检查语法

oldboy是管理员,并且不要密码:
oldboy ALL=(ALL) NOPASSWD: ALL

登录后切到root运行。
[oldboy@oldboyedu ~]$ sudo su - root
Last login: Tue Mar 26 10:32:57 CST 2019 on pts/3
[root@oldboyedu ~]#

为了安全禁止root远程连接linux。

工作中如何登录?使用普通用户登录然后利用sudo提权到root。
Wecomle to oldboy training 58期。
[oldboy@oldboyedu ~]$ whoami
oldboy
[oldboy@oldboyedu ~]$ sudo ls /root
a.txt c.txt data1 etc oldboy oldboy_b oldboy_soft_link pass test.txt user.log
b.txt d d.txt grep.txt oldboy_1.txt oldboyedu.txt oldboy.txt test test.txt.ori
[oldboy@oldboyedu ~]$
[oldboy@oldboyedu ~]$
[oldboy@oldboyedu ~]$ sudo su -
Last login: Tue Mar 26 11:42:09 CST 2019 on pts/0
[root@oldboyedu ~]#


[root@oldboyedu ~]# su - oldboy
Last login: Tue Mar 26 10:44:08 CST 2019 on pts/3
[oldboy@oldboyedu ~]$ ls /root
ls: cannot open directory /root: Permission denied
[oldboy@oldboyedu ~]$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.

[sudo] password for oldboy:
Matching Defaults entries for oldboy on oldboyedu:
User oldboy may run the following commands on oldboyedu:
(ALL) /bin/ls
[oldboy@oldboyedu ~]$ sudo ls /root
a.txt c.txt data1 etc oldboy oldboy_b oldboy_soft_link pass test.txt user.log
b.txt d d.txt grep.txt oldboy_1.txt oldboyedu.txt oldboy.txt test test.txt.ori
[oldboy@oldboyedu ~]$ ls /root
ls: cannot open directory /root: Permission denied
[oldboy@oldboyedu ~]$