Quick HOWTO : Ch09 : Linux Users and Sudo
 |
文章出处: |
{{#if: | {{{2}}} | http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch09_:_Linux_Users_and_Sudo }} |
|
点击翻译: |
English {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/af | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Afrikaans| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/af|Afrikaans]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ar | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|العربية| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ar|العربية]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/az | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|azərbaycanca| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/bcc | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|جهلسری بلوچی| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/bg | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|български| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/bg|български]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/br | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|brezhoneg| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/br|brezhoneg]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ca | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|català| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ca|català]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/cs | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|čeština| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/cs|čeština]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/de | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Deutsch| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/de|Deutsch]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/el | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Ελληνικά| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/es | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|español| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/es|español]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/fa | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|فارسی| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/fa|فارسی]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/fi | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|suomi| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/fi|suomi]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/fr | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|français| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/fr|français]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/gu | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|ગુજરાતી| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/he | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|עברית| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/he|עברית]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/hu | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|magyar| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/hu|magyar]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/id | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Bahasa Indonesia| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/it | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|italiano| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/it|italiano]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ja | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|日本語| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ja|日本語]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ko | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|한국어| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ko|한국어]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ksh | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Ripoarisch| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/mr | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|मराठी| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/mr|मराठी]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ms | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Bahasa Melayu| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/nl | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Nederlands| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/nl|Nederlands]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/no | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|norsk| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/no|norsk]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/oc | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|occitan| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/oc|occitan]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/pl | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|polski| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/pl|polski]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/pt | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|português| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/pt|português]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ro | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|română| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ro|română]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/ru | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|русский| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/ru|русский]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/si | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|සිංහල| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/si|සිංහල]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/sq | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|shqip| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/sq|shqip]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/sr | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|српски / srpski| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/sv | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|svenska| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/sv|svenska]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/th | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|ไทย| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/th|ไทย]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/tr | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Türkçe| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/tr|Türkçe]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/vi | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|Tiếng Việt| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/yue | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|粵語| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/yue|粵語]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/zh | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|中文| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/zh|中文]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/zh-hans | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|中文（简体）| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/zh-hans|中文（简体）]]}}|}} {{#ifexist: {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo | Quick HOWTO : Ch09 : Linux Users and Sudo | {{#if: | :}}Quick HOWTO : Ch09 : Linux Users and Sudo}}/zh-hant | • {{#if: Quick HOWTO : Ch09 : Linux Users and Sudo|中文（繁體）| [[::Quick HOWTO : Ch09 : Linux Users and Sudo/zh-hant|中文（繁體）]]}}|}} |
{{#ifeq:Quick HOWTO : Ch09 : Linux Users and Sudo|:Quick HOWTO : Ch09 : Linux Users and Sudo|请不要直接编辑翻译本页，本页将定期与来源同步。}} |
{{#ifexist: :Quick HOWTO : Ch09 : Linux Users and Sudo/zh | | {{#ifexist: Quick HOWTO : Ch09 : Linux Users and Sudo/zh | | {{#ifeq: {{#titleparts:Quick HOWTO : Ch09 : Linux Users and Sudo|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:Quick HOWTO : Ch09 : Linux Users and Sudo|1|-1|}} | zh | | }}
序言
在我们开始之前，最好先讲一些基本的用户管理系统，这在以后的章节中是非常有用的。添加用户在管理linux盒子中非常重要的一项操作。在这里你会看到几个为以后章节准备简单的例子。你不一定能够完全理解它，but is a good memory refresher（此句不会翻译）。你可以用这个命令man useradd来获得关于用useradd命令添加用户的帮助，或者用命令man usermod来进一步熟悉关于用usermod命令来修改用户的帮助信息。
谁是超级用户？
超级用户被命名为root，在linux中超级用户可以不受任何限制地访问
所有的系统资源和文件。超级用户有一个用户ID，为0，它被linux应用软件普遍的确定为所属于具有最高权限的用户（翻译不好，原文：This user has a user ID, of 0 which is universally identified by Linux applications as belonging to a user with supreme privileges）。你需要以root用户登录来为你的linux服务器添加一个新的用户。
注意：''''当你安装Ubuntu linux系统的时候，系统提示你创建的用户并不是root用户。root会自动建立但是没有密码，所以最初你不能以root用户登录。用sudo su命令，第一个用户可以变成root用户，这在以后会论述。
怎样添加用户
添加用户需要一些计划，在你开始之前先浏览一下下面这几步：
1)按功能排列你要添加的用户所加入的组。在这个例子中有三个群组“parents”，“children"和“soho”。
Parents Children Soho
Paul Accounts Derek Jane Alice
2)在你的服务器中添加linux群组：
[root@bigboy tmp]# groupadd parents
[root@bigboy tmp]# groupadd children [root@bigboy tmp]# groupadd soho
3)添加linux用户并且分配他们到他们各自的群组
[root@bigboy tmp]# useradd -g parents paul
[root@bigboy tmp]# useradd -g parents jane [root@bigboy tmp]# useradd -g children derek [root@bigboy tmp]# useradd -g children alice [root@bigboy tmp]# useradd -g soho accounts [root@bigboy tmp]# useradd -g soho sales
如果你不用-g指定群组，RedHat/Fedora Linux会自动建立一个和你所添加的用户名字一样的群组；也就是用户私有组方案。每一个新用户在第一次登录的时候，都会被提示设置他们新的永久密码。
4)每一个用户的个人目录都被设定在/home目录下。目录的名字就是他们的用户名。
[root@bigboy tmp]# ll /home
drwxr-xr-x 2 root root 12288 Jul 24 20:04 lost+found drwx------ 2 accounts soho 1024 Jul 24 20:33 accounts drwx------ 2 alice children 1024 Jul 24 20:33 alice drwx------ 2 derek children 1024 Jul 24 20:33 derek drwx------ 2 jane parents 1024 Jul 24 20:33 jane drwx------ 2 paul parents 1024 Jul 24 20:33 paul drwx------ 2 sales soho 1024 Jul 24 20:33 sales [root@bigboy tmp]#
怎样更改密码
你需要为第一个帐户创建一个密码。这可以用passwd命令来完成。 系统会提示输入你的旧密码一次，输入你的新密码两次。
用root用户更改用户paul的密码
[root@bigboy root]# passwd paul Changing password for user paul. New password: Retype new password: passwd: all authentication tokens updated successfully. [root@bigboy root]#
用户以后可能会改他们自己的密码。这个例子说明用户paul改自己的密码没有特权。
<pre>[paul@bigboy paul]$ passwd Changing password for paul Old password: your current password Enter the new password (minimum of 5, maximum of 8 characters) Please use a combination of upper and lower case letters and numbers. New password: your new password Re-enter new password: your new password Password changed. [paul@bigboy paul]$
怎样删除用户
userdel命令可以用来把用户记录从目录/etc/passwd和登录进程所用到的目录/etc/shadow中删除。The command has a single argument, the username.（此句不会翻译）
该命令也有一个选项 -r用来将该用户在/home目录下所有的内容一起删除。用这个选项要小心。用户目录下的数据可能非常重要即使该用户已经离开你的公司。
<pre>[root@bigboy tmp]# userdel paul [root@bigboy tmp]# userdel -r paul
怎样让群组知道用户属于哪个群组
Use the groups command with the username as the argument. 用带有用户名作对象'的groups命令（不知道对不对，也不太顺，请高手给出一个更准确的翻译）
'''[root@bigboy root]# groups paul paul : parents'''
'''[root@bigboy root]# '''
怎样更改文件的所有权
你可以用chown命令来更改文件的所有权。第一个对象是该文件 期望的用户名和群组所有权被一个冒号(:)分开，後面是文件名。在下面的例子中，我们改变了名为text.txt的文件的所有权，从root用户和root群组拥有改为testuser用户和users群组拥有：
[root@bigboy tmp]# ll test.txt -rw-r--r-- 1 root root 0 Nov 17 22:14 test.txt [root@bigboy tmp]# chown testuser:users test.txt [root@bigboy tmp]# ll test.txt -rw-r--r-- 1 testuser users 0 Nov 17 22:14 test.txt [root@bigboy tmp]#</pre>
您也可以使用chown命令后加上- R的参数，它能递归搜索目录并改变其权限。
Using sudo
If a server needs to be administered by a number of people it is normally not a good idea for them all to use the root account. This is because it becomes difficult to determine exactly who did what, when and where if everyone logs in with the same credentials. The sudo utility was designed to overcome this difficulty.
The sudo utility allows users defined in the /etc/sudoers configuration file to have temporary access to run commands they would not normally be able to due to file permission restrictions. The commands can be run as user "root" or as any other user defined in the /etc/sudoers configuration file.
The privileged command you want to run must first begin with the word sudo followed by the command's regular syntax. When running the command with the sudo prefix, you will be prompted for your regular password before it is executed. You may run other privileged commands using sudo within a five-minute period without being re-prompted for a password. All commands run as sudo are logged in the log file /var/log/messages.
Simple Sudo Examples
Using sudo is relatively simple as we can see from these examples.
Temporarily Gaining root Privileges
In this example, user bob attempts to view the contents of the /etc/sudoers file, which is an action that normally requires privileged access. Without sudo, the command fails:
[bob@bigboy bob]$ more /etc/sudoers /etc/sudoers: Permission denied [bob@bigboy bob]$
Bob tries again using sudo and his regular user password and is successful:
[bob@bigboy bob]$ sudo more /etc/sudoers Password: ... ... [bob@bigboy bob]$
The details of configuring and installing sudo are covered in later sections.
Becoming root for a Complete Login Session
The su command allows a regular user to become the system's root user if they know the root password. A user with sudo rights to use the su command can become root, but they only need to know their own password, not that of root as seen here.
someuser@u-bigboy:~$ sudo su - Password: root@u-bigboy:~#
Some systems administrators will use sudo to grant root privileges to their own personal user account without the need to provide a password.
Later sections describe how to disable sudo su ability and also how to use sudo without password prompts.
Downloading and Installing the sudo Package
Fortunately the package is installed by default by RedHat/Fedora which eliminates the need to anything more in this regard. The visudo Command
The visudo command is a text editor that mimics the vi editor that is used to edit the /etc/sudoers configuration file. It is not recommended that you use any other editor to modify your sudo parameters because the sudoers file isn't located in the same directory on all versions of Linux. visudo uses the same commands as the vi text editor. The visudo command must run as user root and should have no arguments:
[root@aqua tmp]# visudo
The /etc/sudoers File
The /etc/sudoers file contains all the configuration and permission parameters needed for sudo to work. There are a number of guidelines that need to be followed when editing it with visudo. General /etc/sudoers Guidelines
The /etc/sudoers file has the general format shown in Table 9-1.
Table 9-1 Format of the /etc/sudoers File
|
General sudoers File Record Format |
|
usernames/group servername = (usernames command can be run as) command |
There are some general guidelines when editing this file:
- Groups are the same as user groups and are differentiated from regular users by a % at the beginning. The Linux user group "users" would be represented by %users.
- You can have multiple usernames per line separated by commas.
- Multiple commands also can be separated by commas. Spaces are considered part of the command.
- The keyword ALL can mean all usernames, groups, commands and servers.
- If you run out of space on a line, you can end it with a back slash (\) and continue on the next line.
- sudo assumes that the sudoers file will be used network wide, and therefore offers the option to specify the names of servers which will be using it in the servername position in Table 9-1. In most cases, the file is used by only one server and the keyword ALL suffices for the server name.
- The NOPASSWD keyword provides access without prompting for your password.
Simple /etc/sudoers Examples
This section presents some simple examples of how to do many commonly required tasks using the sudo utility.
Granting All Access to Specific Users
You can grant users bob and bunny full access to all privileged commands, with this sudoers entry.
bob, bunny ALL=(ALL) ALL
This is generally not a good idea because this allows bob and bunny to use the su command to grant themselves permanent root privileges thereby bypassing the command logging features of sudo. The example on using aliases in the sudoers file shows how to eliminate this prob
Granting Access To Specific Users To Specific Files
This entry allows user peter and all the members of the group operator to gain access to all the program files in the /sbin and /usr/sbin directories, plus the privilege of running the command /usr/local/apps/check.pl. Notice how the trailing slash (/) is required to specify a directory location:
peter, %operator ALL= /sbin/, /usr/sbin, /usr/local/apps/check.pl
Notice also that the lack of any username entries within parentheses () after the = sign prevents the users from running the commands automatically masquerading as another user. This is explained further in the next example.
Granting Access to Specific Files as Another User
The sudo -u entry allows allows you to execute a command as if you were another user, but first you have to be granted this privilege in the sudoers file.
This feature can be convenient for programmers who sometimes need to kill processes related to projects they are working on. For example, programmer peter is on the team developing a financial package that runs a program called monthend as user accounts. From time to time the application fails, requiring "peter" to stop it with the /bin/kill, /usr/bin/kill or /usr/bin/pkill commands but only as user "accounts". The sudoers entry would look like this:
peter ALL=(accounts) /bin/kill, /usr/bin/kill /usr/bin/pkill
User peter is allowed to stop the monthend process with this command:
[peter@bigboy peter]# sudo -u accounts pkill monthend
Granting Access Without Needing Passwords
This example allows all users in the group operator to execute all the commands in the /sbin directory without the need for entering a password. This has the added advantage of being more convenient to the user:
%operator ALL= NOPASSWD: /sbin/
Using Aliases in the sudoers File
Sometimes you'll need to assign random groupings of users from various departments very similar sets of privileges. The sudoers file allows users to be grouped according to function with the group and then being assigned a nickname or alias which is used throughout the rest of the file. Groupings of commands can also be assigned aliases too.
In the next example, users peter, bob and bunny and all the users in the operator group are made part of the user alias ADMINS. All the command shell programs are then assigned to the command alias SHELLS. Users ADMINS are then denied the option of running any SHELLS commands and su:
Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, \
/usr/bin/ksh, /usr/local/bin/tcsh, \
/usr/bin/rsh, /usr/local/bin/zsh
User_Alias ADMINS = peter, bob, bunny, %operator
ADMINS ALL = !/usr/bin/su, !SHELLS
This attempts to ensure that users don't permanently su to become root, or enter command shells that bypass sudo's command logging. It doesn't prevent them from copying the files to other locations to be run. The advantage of this is that it helps to create an audit trail, but the restrictions can be enforced only as part of the company's overall security policy.
Other Examples
You can view a comprehensive list of /etc/sudoers file options by issuing the command man sudoers.
Using syslog To Track All sudo Commands
All sudo commands are logged in the log file /var/log/messages which can be very helpful in determining how user error may have contributed to a problem. All the sudo log entries have the word sudo in them, so you can easily get a thread of commands used by using the grep command to selectively filter the output accordingly.
Here is sample output from a user bob failing to enter their correct sudo password when issuing a command, immediately followed by the successful execution of the command /bin/more sudoers.
[root@bigboy tmp]# grep sudo /var/log/messages Nov 18 22:50:30 bigboy sudo(pam_unix)[26812]: authentication failure; logname=bob uid=0 euid=0 tty=pts/0 ruser= rhost= user=bob Nov 18 22:51:25 bigboy sudo: bob : TTY=pts/0 ; PWD=/etc ; USER=root ; COMMAND=/bin/more sudoers [root@bigboy tmp]#
Conclusion
It is important to know how to add users, not just so they can log in to our system. Most server based applications usually run via a dedicated unprivileged user account, for example the MySQL database application runs as user mysql and the Apache Web server application runs as user apache. These accounts aren't always created automatically, especially if the software is installed using TAR files.
Finally, the sudo utility provides a means of dispersing the responsibility of systems management to multiple users. You can even give some groups of users only partial access to privileged commands depending on their roles in the organization. This makes sudo a valuable part of any company's server administration and security policy.
