Sudo Settings
2017/12/13 |
Configure Sudo to separate users' duty if some people share privileges.
It's unnecessarry to install sudo manually because it is installed by default even if Minimal Install.
|
|
[1] | Transfer root privilege to a user all. |
[root@dlp ~]#
# add to the end: user [fedora] can use all root privilege fedora ALL=(ALL) ALL # how to write ⇒ destination host=(owner) command # verify with user [fedora] [fedora@dlp ~]$ /bin/cat /etc/shadow cat: /etc/shadow: Permission denied # denied normally
Password:
tcpdump:!!:16973::::::# own password systemd-coredump:!!:16973:::::: # just executed
|
[2] | In addition to the setting [1], set that some commands are not allowed. |
[root@dlp ~]#
# near line 49: add aliase for the kind of shutdown commands Cmnd_Alias SHUTDOWN = /sbin/halt, /sbin/shutdown, \ /sbin/poweroff, /sbin/reboot, /sbin/init, /bin/systemctl # add ( commands in aliase [SHUTDOWN] are not allowed ) fedora ALL=(ALL) ALL, !SHUTDOWN
# verify with user [fedora] [fedora@dlp ~]$ Password: Sorry, user fedora is not allowed to execute '/sbin/shutdown -r now' as root on dlp.srv.world. # æ‹’å¦ã•ã‚ŒãŸ
|
[3] | Transfer some commands with root privilege to users in a group. |
[root@dlp ~]#
# near line 51: add aliase for the kind of user management comamnds Cmnd_Alias USERMGR = /sbin/useradd, /sbin/userdel, /sbin/usermod, \ /bin/passwd # add to the end %usermgr ALL=(ALL) USERMGR # verify with user [fedora] [fedora@dlp ~]$ [fedora@dlp ~]$ # done normally [fedora@dlp ~]$ Changing password for user testuser. New UNIX password: # set testuser's password Retype new UNIX password: passwd: all authentication tokens updated successfully. |
[4] | Transfer a command with root privilege to a user. |
[root@dlp ~]#
# add at the end fedora ALL=(ALL) /sbin/visudo cent ALL=(ALL) /sbin/useradd, /sbin/userdel, /sbin/usermod, /bin/passwd ubuntu ALL=(ALL) /bin/vi # verify with user [fedora] # possible to open and edit ## Sudoers allows particular users to run various commands as ## the root user, without needing the root password. ## # verify with user [cent] [cent@dlp ~]$
[cent@dlp ~]$
# done normally # verify with user [ubuntu] # possible to open and edit # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that |
[5] | The logs for sudo are kept in [/var/log/secure], but there are many kind of logs in it. If you'd like to keep only sudo's log in another file, Configure like follows. |
[root@dlp ~]#
# add to the end # for example, output logs to [local1] facility Defaults syslog=local1
[root@dlp ~]#
vi /etc/rsyslog.conf # line 46,47: add *.info;mail.none;authpriv.none;cron.none;local1.none /var/log/messages local1.* /var/log/sudo.log # The authpriv file has restricted access. authpriv.* /var/log/secure[root@dlp ~]# systemctl restart rsyslog |