Sudo Settings
2015/05/27 |
Configure Sudo to separate users' duty if some people share privileges.
It's unnecessarry to install sudo manually because it is installed by default even if "Minimal Install".
|
|
[1] | Transfer root privilege to a user all. |
[root@dlp ~]#
# add to the end: user 'fedora' can use all root privilege fedora ALL=(ALL) ALL # how to write ⇒ destination host=(owner) command # make sure with the user 'fedora' [fedora@dlp ~]$ /bin/cat /etc/shadow cat: /etc/shadow: Permission denied # denied normally Password:
smmsp:!!:15721::::::# own password sshd:!!:15721:::::: # just executed
|
[2] | In addition to the setting [1], set that some commands are not allowed. |
[root@dlp ~]#
# near line 49: add aliase for the kind of shutdown commands Cmnd_Alias SHUTDOWN = /sbin/halt, /sbin/shutdown, \ /sbin/poweroff, /sbin/reboot, /sbin/init # add ( commands in aliase 'SHUTDOWN' are not allowed ) fedora ALL=(ALL) ALL, !SHUTDOWN # make sure with user 'fedora' [fedora@dlp ~]$ Password: Sorry, user fedora is not allowed to execute '/sbin/shutdown -r now' as root on dlp.srv.world. # denied normally
|
[3] | Transfer some commands with root privilege to users in a group. |
[root@dlp ~]#
# near line 51: add aliase for the kind of user management comamnds Cmnd_Alias USERMGR = /sbin/useradd, /sbin/userdel, /sbin/usermod, \ /bin/passwd # add to the end %usermgr ALL=(ALL) USERMGR # make sure with user 'fedora' [fedora@dlp ~]$ [fedora@dlp ~]$ # done normally [fedora@dlp ~]$ Changing password for user testuser. New UNIX password: # set testuser's password Retype new UNIX password: passwd: all authentication tokens updated successfully. |
[4] | Transfer a command with root privilege to a user. |
[root@dlp ~]#
# add at the end fedora ALL=(ALL) /sbin/visudo cent ALL=(ALL) /sbin/useradd, /sbin/userdel, /sbin/usermod, /bin/passwd ubuntu ALL=(ALL) /bin/vi # make sure with user 'fedora' # possible to open and edit ## Sudoers allows particular users to run various commands as ## the root user, without needing the root password. ## # make sure with user 'cent' [cent@dlp ~]$
[cent@dlp ~]$
# normally done # make sure with user 'ubuntu' # possible to open and edit # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that |
[5] | The logs for sudo are kept in '/var/log/secure', but there are many kind of logs in it. So if you'd like to keep only sudo's log in a file, Set like follows. |
[root@dlp ~]#
# add to the end Defaults syslog=local1
[root@dlp ~]#
vi /etc/rsyslog.conf # line 59,60: add *.info;mail.none;authpriv.none;cron.none; local1.none /var/log/messageslocal1.* /var/log/sudo.log # The authpriv file has restricted access. authpriv.* /var/log/secure[root@dlp ~]# systemctl restart rsyslog |