Sudoers file parsing

Sudoers file parsing
Today, a common user is added to the user group, and the user does not have sudo permissions. Therefore, the sudo configuration file is modified through sudo logs do and the root permission is granted to the common user. Later I thought about changing the access permission of the/etc/sudoers file to 777, and then editing the file directly. So I did not want to do that either. After the change, I found that I had dug a hole for myself and kept myself out of sudo. /Etc/sudoers is The sudo configuration file, and its attribute must be 440. When I use sudo chmod 777/etc/sudoers to modify the access permission of the sudoers file, sudo cannot be reused. If you want to use sudo chmod 440/etc/sudoers to modify the access permission of the sudoers file, or if you use sudo, the following error occurs: sudo:/etc/sudoers is mode 0777, shocould be 0440. In this way, you can lock yourself out of sudo. In this case, it is no longer possible to switch to the root user through sudo su or sudo-I. In this case, you can use su root to switch to root. In this way, you can modify the access permission of the/etc/sudoers file. The problem is solved. Later, I found an article on sudoers file parsing on the Internet, which will be pasted below. Sudo is a tool that allows the system administrator to allow common users to execute some or all of the root commands, such as halt, reboot, and su. This not only reduces the login and management time of the root user, but also improves the security. Sudo is not a substitute for shell. It is intended for every command. It has the following features: § Sudo can restrict users to only run certain commands on a host. § Sudo provides a wide range of logs that detail what each user has done. It can upload logs to the central host or log server. § Sudo uses a timestamp file to execute a similar "ticket checking" system. When the user calls sudo and enters its password, the user receives a 5-minute ticket (this value can be changed during compilation ). § The Sudo configuration file is a sudoers file, which allows the system administrator to centrally manage user permissions and hosts used. It is stored in/etc/sudoers by default, and the attribute must be 0411. Edit the configuration file command: visudo Default Configuration File Location:/etc/sudoers [root @ localhost ~] # Cat/etc/sudoers # sudoers file. # This file MUST be edited with the 'usually do 'command as root. # See the sudoers man page for the details on how to write a sudoers file. # Host alias specification # User alias specification # Cmnd alias specification # Defaults specification # Runas alias specification # User privilege specificationroot ALL = (ALL) ALL # Uncomment to allow people in group wheel to ru N all commands # % wheel ALL = (ALL) ALL # Same thing without a password # % wheel ALL = (ALL) NOPASSWD: ALL # Samples # % users ALL =/sbin/mount/cdrom,/sbin/umount/cdrom # % users localhost =/sbin/shutdown-h now [root @ localhost ~] # You can use mongodo to edit the sudoers configuration file, but you can also directly modify the sudoers file. However, you 'd better check its sample before editing. sudoers file, which contains a very detailed example for reference. # Part 1: user defined. Users are divided into three categories: FULLTIMERS, PARTTIMERS, and WEBMASTERS. User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias PARTTIMERS = bostley, shortfox, crawl User_Alias WEBMASTERS = will, wendy, wim # The second part classifies the operation types. Runas_Alias OP = root, operator Runas_Alias DB = oracle, sybase # Part 3: Host classification. These are all randomly divided for better management. Host_Alias iSCSI = bigtime, eclipse, moet, anchor: \ SGI = grolsch, dandelion, black: \ ALPHA = widget, thalamus, foobar: \ HPPA = boa, nag, python Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CSNETS = Hangzhou, Hangzhou/24,128.138 .242.0 Host_Alias SERVERS = master, mail, www, ns Host_Alias CDROM = orion, perseus, hercules # Part 4, define the command and command path. The command must use an absolute path to avoid the execution of commands with the same name in other directories, resulting in security risks. Therefore, the absolute path is also used! Cmnd_Alias DUMPS =/usr/bin/mt,/usr/sbin/dump,/usr/sbin/rdump, \/usr/sbin/restore, /usr/sbin/rrestore Cmnd_Alias KILL =/usr/bin/kill Cmnd_Alias PRINTING =/usr/sbin/lpc, /usr/bin/lprm Cmnd_Alias SHUTDOWN =/usr/sbin/shutdown Cmnd_Alias HALT =/usr/sbin/halt, /usr/sbin/fasthalt Cmnd_Alias REBOOT =/usr/sbin/reboot,/usr/sbin/fastboot Cmnd_Alias SHELLS =/usr/bin/sh,/usr/bin/csh, /usr/bin/ksh ,\ /Usr/local/bin/tcsh,/usr/bin/rsh, \/usr/local/bin/zsh Cmnd_Alias SU =/usr/bin/su # different policies are used for different users. For example, all syslogs are output directly through auth by default. The FULLTIMERS group does not need to see lecture (the message generated during the first running); millert does not need to enter a password when using sudo; and the path of logfile is/var/log/sudo. log and each line of log must contain the year. Defaults syslog = auth Defaults: FULLTIMERS! Lecture Defaults: millert! Authenticate Defaults @ SERVERS log_year, logfile =/var/log/sudo. log # Members of the root and wheel groups have any rights. If you want to define a group of users, you can add % before the group name to set it. root ALL = (ALL) ALL % wheel ALL = (ALL) ALL # FULLTIMERS can run any command on any host without entering its own password fulltimers all = NOPASSWD: ALL # PARTTIMERS can run any command on any host, but you must first verify your password. Parttimers all = ALL # jack can run any command in the defined CSNET (128.138.243.0, 128.138.242.0 and 128.138.204.0/24 subnets), but note that the first two do not need to match the subnet mask, the next one must match the mask. Jack CSNETS = ALL # lisa can run any command on the host defined as CUNETS (128.138.0.0) subnet. Lisa CUNETS = ALL # user operator can run DUMPS, KILL, PRINTING, SHUTDOWN, HALT, REBOOT, and ALL the commands in/usr/release/bin. Operator ALL = DUMPS, KILL, PRINTING, SHUTDOWN, HALT, REBOOT, \/usr/users/bin/# joe can run the su operator command joe ALL =/usr/bin/su operator # pete can change the password for users other than root. Pete HPPA =/usr/bin/passwd [A-z] *,! /Usr/bin/passwd root # bob can run commands like root and operator in the OP user group on both the Linux and SGI machines. Bob iSCSI = (OP) ALL: SGI = (OP) ALL # jim can run any command in the biglab network group. By default, "+" is the prefix of a network group. Jim + biglab = ALL # In secretaries, users help manage printers and can run adduser and rmuser commands. + Secretaries ALL = PRINTING,/usr/bin/adduser,/usr/bin/rmuser # fred can directly run oracle or sybase databases. Fred ALL = (DB) NOPASSWD: ALL # john can be on the ALPHA machine, and su can be owned by ALL except root. John ALPHA =/usr/bin/su [! -] *,! /Usr/bin/su * root * # jen can run any command on machines except the SERVERS Host group. Jen ALL ,! SERVERS = ALL # jill can run ALL commands except su and shell commands in/usr/bin/on SERVERS. Jill SERVERS =/usr/bin /,! SU ,! SHELLS # steve can run any command in/usr/local/op_commands/on the CSNETS host as a common user. Steve CSNETS = (operator)/usr/local/op_commands/# matt can run the kill command on his personal workstation. Matt valkyrie = KILL # users in the WEBMASTERS user group can run any command or su www Using the www user name. WEBMASTERS www = (www) ALL, (root)/usr/bin/su www # any user can mount or umount a cd-rom on the CDROM host without entering a password. All cdrom = NOPASSWD:/sbin/umount/CDROM, \/sbin/mount-o nosuid \, nodev/dev/cd0a/CDROM 3. Use command name: sudo permission: user usage in/etc/sudoers: sudo-V sudo-h sudo-l sudo-v sudo-k sudo-s sudo-H sudo [-B] [-p prompt] [-u username/# uid]- s usage: sudo command: Execute the command as a system administrator. That is to say, the command executed by sudo is like executing the parameter by the root user: -V: display version number-h: display version number and instructions-l: Display yourself (the user who executes sudo) -v because sudo does not execute the command during the first execution or within N minutes. Line (N defaults to 5) will ask the password, this parameter is a re-confirmation, if more than N minutes, you will also ask the password-k will force the user to ask the password (whether or not it exceeds N minutes) during the next sudo execution) -B puts the command to be executed in the background. Execute-p prompt to change the password prompt, where % u will replace it with the user's account name, % h indicates that the host name-u username/# uid does not contain this parameter. This parameter indicates that the command is to be executed as root, and this parameter is added, the command can be executed as username (# uid is the username's user number)-s. The SHELL specified by the shell in the environment variable is executed, or, the shell-H specified in/etc/passwd sets the HOME directory in the environment variable) specify the Home Directory of the user who wants to change the identity (if the-u parameter is not added, it is the root of the system administrator). The command must be executed as the system administrator (or changed to another user by-u ). Command example: sudo-l list current permissions sudo-V List sudo version information command name: sudoers (the command cannot be found under fc5, however, man can check its usage .) Used to display users who can use sudo