##################################################
################ #命令权限的下放 ###################
1.sudo:sudo can allow you to execute commands as other users (usually as root) not all people can use sudo, only users within the/etc/sudoers can take the > sudo command.
[Email protected] ~]# sudo-u sshd touch/tmp/fil
[Email protected] ~]# Ls-ld/tmp/fil
-rw-r--r--. 1 sshd sshd 0 October 8 20:54/tmp/fil # #从root身份切换到sshd的身份来创建目录
Because the/etc/sudoers file is syntactically, it is common to use the Visudo command to modify the contents of the file if it is not possible to set the error by using sudo
1). Single user can use all commands of root:
# # Allow Root to run any commands [email protected] ~]$ sudo passwd
Sorry, User Hao is not allowed to execute '/bin/passwd ' as root on localhost.
[email protected] ~]$ sudo passwd hao
Changing password for user Hao.
Nywhere
98 root all= (All) all
Student All= (All) all # #更改sudo内的文件内容 The syntax format for this statement is detailed in bird brother P431
After the modification found:
[email protected] ~]$ sudo useradd hao
[sudo] password for student:
[Email protected] ~]$ Su-hao # #student用户可以执行root用户的命令来添加用户了
*****************************************************
Root all= (All) all
1 2 3 4
1. User account: Which account of the system can use sudo this command, the default is only the root account
2. The source hostname of the lander
3. Switchable identities
4. Executable command: must be written using absolute path
* * All for special keywords, representing any identity, host or command meaning
2) through the function of the group to enable users to manage the system
* # allows people in group wheel to run all commands
106%wheel all= (All) all
108 # Same thing without a password
109 #%wheel All= (All) Nopasswd:all
With these lines we can see that as long as you join wheel This user group can run all commands!
[Email protected] ~]# usermod-g wheel Student
[Email protected] ~]# Su-student # #加入该用户组并且切换到student用户下
[email protected] ~]$ sudo useradd Zeng # #发现可以使用useradd了
If the sense of implementation sudo to enter the user password cumbersome, you can add nopasswd: This sentence, similar to the 109 line of view
3) delegating the specified command to the specified host
# allow ROOT to run any commands anywhere
Root all= (All) all
Hao localhost= (Root) nopasswd:/usr/bin/passwd # #使localhost这台主机上可以以root的身份执行/usr/bin/passwd> this command
Root all= (All) all
Hao localhost= (Root) nopasswd:!/usr/bin/passwd,/usr/bin/passwd [a-za-z]*,!/usr/bin/passwd Root
# #这样修改后发现hao这个用户无法使用passwd命令来更改root的密码, but you can change other users with their own passwords
[email protected] ~]$ sudo passwd
Sorry, User Hao is not allowed to execute '/bin/passwd ' as root on localhost.
[email protected] ~]$ sudo passwd hao
Changing password for user Hao.
################# #end #################################
The delegation of Linux Learning Command Authority--10.1
