1. Introduction to sudo
Sudo is a common tool in linux that allows common users to use superuser permissions. It allows system administrators to execute some or all of the root commands, such as halt, reboot, and su. This not only reduces the login and management time of the root user, but also improves the security. Sudo is not a substitute for shell. It is intended for every command. It has the following features:
§ Sudo can restrict users from running certain commands only on a host.
§ Sudo provides a wide range of logs that detail what each user has done. It can upload logs to the central host or log server.
§ Sudo uses a timestamp file to execute a similar "ticket checking" system. When the user calls sudo and enters its password, the user receives a 5-minute ticket (this value can be changed during compilation ).
§ The sudo configuration file is a sudoers file, which allows the system administrator to centrally manage user permissions and hosts used. It is stored in/etc/sudoers by default, and the attribute must be 0411.
2. the main configuration file of the configuration file/etc/sudoers is sudoers, which is usually in the/etc directory in linux. If it is solaris, sudo is not installed by default, after compilation and installation, it is usually in the etc directory of the installation directory. However, no matter where the sudoers file is, sudo provides a command to edit the file: Modify do to modify the file. We strongly recommend that you use this command to modify sudoers, because it will help you verify that the file configuration is correct. If it is incorrect, it will prompt you which segment of configuration is wrong when saving and exiting.
The following describes how to configure sudoers.
First, write the default configuration of sudoers:
######################################## #####################
# Sudoers file.
#
# This file MUST be edited with the 'mongodo 'command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#
# Host alias specification
# User alias specification
# Cmnd alias specification
# Defaults specification
# User privilege specification
Root ALL = (ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# % Wheel ALL = (ALL) ALL
# Same thing without a password
# % Wheel ALL = (ALL) NOPASSWD: ALL
# Samples
# % Users ALL =/sbin/mount/cdrom,/sbin/umount/cdrom
# % Users localhost =/sbin/shutdown-h now
######################################## ##########################
1. The simplest configuration gives normal user support all root permissions
After you execute mongodo, you can see that there is only one configuration by default:
Root ALL = (ALL) ALL
Then you can add a configuration below:
Support ALL = (ALL) ALL
In this way, general user support can execute all the commands with the root permission
After logging on as a support user, run:
Sudo su-
Enter the password of the support user to switch to the root user.
2. allow normal user support to run only some commands that the root user can execute on a certain number of servers.
First, you need to configure some Alias. In this way, it is easier to configure the permission below, so you do not need to write the configuration of Large segments. Alias is mainly divided into four types
Host_Alias
Cmnd_Alias
User_Alias
Runas_Alias
1) Configure Host_Alias: Host list
Host_Alias HOST_FLAG = hostname1, hostname2, hostname3
2) Configure Cmnd_Alias: the list of commands that can be executed
Cmnd_Alias COMMAND_FLAG = command1, command2, command3
3) Configure User_Alias: A list of users with sudo permissions.
User_Alias USER_FLAG = user1, user2, user3
4) Configure Runas_Alias: the list of identities (such as root or oracle) that the user executes.
Runas_Alias RUNAS_FLAG = operator1, operator2, operator3
5) Configure permissions
The permission configuration format is as follows:
USER_FLAG HOST_FLAG = (RUNAS_FLAG) COMMAND_FLAG
If password verification is not required, configure it in this format.
USER_FLAG HOST_FLAG = (RUNAS_FLAG) NOPASSWD: COMMAND_FLAG
Configuration example:
######################################## ####################################
# Sudoers file.
#
# This file MUST be edited with the 'mongodo 'command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#
# Host alias specification
Host_Alias EPG = 192.168.1.1, 192.168.1.2
# User alias specification
# Cmnd alias specification
Cmnd_Alias SQUID =/opt/vtbin/squid_refresh,/sbin/service,/bin/rm
# Defaults specification
# User privilege specification
Root ALL = (ALL) ALL
Support EPG = (ALL) NOPASSWD: SQUID
# Uncomment to allow people in group wheel to run all commands
# % Wheel ALL = (ALL) ALL
# Same thing without a password
# % Wheel ALL = (ALL) NOPASSWD: ALL
# Samples
# % Users ALL =/sbin/mount/cdrom,/sbin/umount/cdrom
# % Users localhost =/sbin/shutdown-h now
######################################## #######################
