Refer to these articles for the steps on how to give a user or group permission to run certain commands. Now, the user or group that has been granted permission to run certain commands can use the sudo command to issue commands that require elevated privileges. Aliases can be used for each section.
Let's take an example where multiple users need permission to run multiple commands on certain hosts using a certain user and group. For example, Tim and Tammy and Roger and Dawn need permission to execute the halt and init and poweroff and reboot and shutdown and telinit commands on Toggle navigation FreeKB. Give a user permission to run certain commands Give a group permission to run certain commands Now, the user or group that has been granted permission to run certain commands can use the sudo command to issue commands that require elevated privileges.
The default user for the su command is root. Then you will enter the password for the root account, giving you a shell prompt where you can run any command as root. Again, this not safe. Once you are logged in as root, the system is open to vulnerabilities. However, your username must be in the sudoers file. Using -l after ls will give you a long and detailed listing. Here is a layout of the sudoers file in Ubuntu.
Your sudoers file may differ depending on the type of system you are using but should be the same genetically. See the man page for details on how to write a sudoers file. Host alias specification. User alias specification. Cmnd alias specification. Members of the admin group may gain root privileges. Now your user account has sudo rights, or you are finally on that VIP list. In Ubuntu, there is a group called sudo that grant users added to it system rights after they have submitted their password.
This specifies rights to it. The same goes for the admin group. This indicates that admin and sudo are system groups. See Other special characters and reserved words for a list of characters that need to be escaped.
Note that user names and groups are matched as strings. In other words, two users groups with the same uid gid are considered to be distinct. If you wish to match all user names with the same uid e. Host netgroups are matched using the host both qualified and unqualified and domain members only; the user member is not used when matching. If you specify a network number without a netmask, sudo will query each of the local host's network interfaces and, if the network number corresponds to one of the hosts's network interfaces, will use the netmask of that interface.
The netmask may be specified either in standard IP address notation e. A host name may include shell-style wildcards see the Wildcards section below , but unless the host name command on your machine returns the fully qualified host name, you'll need to use the fqdn option for wildcards to be useful. Note that sudo only inspects actual network interfaces; this means that IP address A command name is a fully qualified file name which may include shell-style wildcards see the Wildcards section below.
However, you may also specify command line arguments including wildcards. Alternately, you can specify "" to indicate that the command may only be run without command line arguments. If a Cmnd has associated command line arguments, then the arguments in the Cmnd must match exactly those given by the user on the command line or match the wildcards if there are any. It may take command line arguments just as a normal command does.
This may be useful in situations where the user invoking sudo has write access to the command or its parent directory. The following digest formats are supported: sha, sha, sha and sha The string may be specified in either hex or base64 format base64 is more compact. There are several utilities capable of generating SHA-2 digests in hex format such as openssl, shasum, shasum, shasum, shasum, shasum. These may affect all users on any host, all users on a specific host, a specific user, a specific command, or commands being run as a specific user.
Note that per-command entries may not include command line arguments. Parameters may be flags , integer values, strings , or lists. Some integer, string and list parameters may also be used in a boolean context to disable them. Values may be enclosed in double quotes "" when they contain multiple words.
These operators are used to add to and delete from a list respectively. Defaults entries are parsed in the following order: generic, host and user Defaults first, then runas Defaults and finally command defaults. A user specification determines which commands a user may run and as what user on specified hosts. By default, commands are run as root , but this can be changed on a per-command basis.
Let's break that down into its constituent parts:. The second defines a list of groups that can be specified via sudo 's -g option. If only the first is specified, the command may be run as any user in the list but no -g option may be specified. What this means is that for the entry:. If we modify the entry like so:. If no group is specified on the command line, the command will run with the group listed in the target user's password database entry.
The following would all be permitted by the sudoers entry above:. In the following example, user tcm may run commands that access a modem device file with the dialer group. Note that in this example only the group will be set, the command still runs as user tcm. In this example:. If a role or type is specified with the command it will override any default values specified in sudoers.
A role or type specified on the command line, however, will supersede the values in sudoers. If privileges or limit privileges are specified with the command it will override any default values specified in sudoers.
A privilege set is a comma-separated list of privilege names. The ppriv 1 command can be used to list all privileges known to the system.
A command may have zero or more tags associated with it. If sudo has been compiled with noexec support and the underlying operating system supports it, the NOEXEC tag can be used to prevent a dynamically-linked executable from running further commands itself. They have no effect when sudo is run with the -l or -v options. By default, sudo requires that a user authenticate him or herself before running a command.
This behavior may be overridden via the verifypw and listpw options. These tags override the value of the setenv option on a per-command basis. As such, only trusted users should be allowed to set variables in this manner. Character classes may be used if your system's glob 3 and fnmatch 3 functions support them. This is to make a path like:. When matching the command line arguments, however, a slash does get matched by wildcards since command line arguments may contain arbitrary strings and not just path names.
In most cases it is better to do command line processing outside of sudoers in a scripting language. It is possible to include other sudoers files from within the sudoers file currently being parsed using the include and includedir directives.
This can be used, for example, to keep a site-wide sudoers file in addition to a local, per-machine file. Files that are included may themselves include other files.
A hard limit of nested include files is enforced to prevent include file loops. The includedir directive can be used to create a sudoers. For example, given:. Files are parsed in sorted lexical order. Using a consistent number of leading zeroes in the file names can be used to avoid such problems. Note that unlike files included via include , visudo will not edit the files in a includedir directory unless one of them contains a syntax error.
It is still possible to run visudo with the -f flag to edit the files directly, but this will not catch the redefinition of an alias that is also present in a different file. Both the comment character and any text after it, up to the end of the line, are ignored. The reserved word ALL is a built-in alias that always causes a match to succeed. You should not try to define your own alias called ALL as the built-in alias will be used in preference to your own. Please note that using ALL can be dangerous since in a command context, it allows the user to run any command on the system.
This allows one to exclude certain values. For example, to match all users except for root one would use:. A list of all supported Defaults parameters, grouped by type, are listed below. Boolean Flags :. For this to work seamlessly, the operating system must support the automatic restarting of system calls.
Unfortunately, not all operating systems do this by default, and even those that do may have bugs. Some versions of the linux su 1 command behave this way. This flag is off by default. This setting is only supported by version 1. If the machine's hosts file entry is not formatted properly, the fqdn option will not be effective if it is queried before DNS.
0コメント