|
Configure sudo
2010/07/18 |
| Configure sudo to separate users' duty if some people share privileges.
|
|
| [1] | Transfer root privilege to a user all |
|
root@ubuntu:~# # add at the bottom: user 'lucid' can use all root privilege
lucid ALL=(ALL) ALL
# how to write ⇒ destination host=(owner) command # if quit visudo, push "Ctrl + x" key # make sure with user 'lucid' lucid@ubuntu:~$ /sbin/shutdown -r now shutdown: Need to be root # denied normally lucid@ubuntu:~$ [sudo] password for lucid: # own password lucid@ubuntu:~$ Broadcast message from lucid (/dev/pts/0) at 15:27 ... The system is going down for reboot NOW! # just executed
|
| [2] | In addition to the setting [1], some commands are not allow |
|
root@ubuntu:~# # add aliase for the kind of shutdown commands # Cmnd alias specification Cmnd_Alias SHUTDOWN = /sbin/halt, /sbin/shutdown, \ /sbin/poweroff, /sbin/reboot, /sbin/init # add ( commands in aliase 'SHUTDOWN' are not allowed ) lucid ALL=(ALL) ALL, !SHUTDOWN # make sure with user 'lucid' lucid@ubuntu:~$ [sudo] password for lucid: Sorry, user lucid is not allowed to execute '/sbin/shutdown -r now' as root on ubuntu.srv.world. # denied
|
| [3] | Transfer some commands with root privilege to users in a group |
|
root@ubuntu:~# # add aliase for the kind of user management comamnds # Cmnd alias specification Cmnd_Alias USERMGR = /usr/sbin/adduser, /usr/sbin/useradd, /usr/sbin/newusers, \ /usr/sbin/deluser, /usr/sbin/userdel, /usr/sbin/usermod, /usr/bin/passwd # add at the bottom %usermgr ALL=(ALL) USERMGR root@ubuntu:~# groupadd usermgr root@ubuntu:~# vi /etc/group # add users in this group usermgr:x:1002: fedora # make sure with user 'fedora' fedora@ubuntu:~$ fedora@ubuntu:~$ # done normally fedora@ubuntu:~$ Enter new UNIX password: # set testuser's password Retype new UNIX password: passwd: password updated successfully |
| [4] | Transfer a command with root provilege to a user |
|
root@ubuntu:~# # add at the bottom
fedora ALL=(ALL) /usr/sbin/visudo cent ALL=(ALL) /usr/sbin/adduser, /usr/sbin/useradd, /usr/sbin/newusers, \ /usr/sbin/deluser, /usr/sbin/userdel, /usr/sbin/usermod, /usr/bin/passwd suse ALL=(ALL) /usr/bin/vim # make sure with user 'fedora' fedora@ubuntu:~$ # possible to open and edit ## Sudoers allows particular users to run various commands as ## the root user, without needing the root password. ## # make sure with user 'cent' cent@ubuntu:~$ cent@ubuntu:~$ # done normally # make sure with user 'suse' suse@ubuntu:~$ # possible to open and edit # ~/.profile: executed by Bourne-compatible login shells. |
| [5] | The logs for sudo are kept in '/var/log/auth.log', but there are many kind of logs in it. So if you'd like to keep only sudo log in a file, Set like follows. |
|
root@ubuntu:~# # add at the bottom Defaults syslog=local1 root@ubuntu:~# vi /etc/rsyslog.d/50-default.conf # line 8: add local1.* /var/log/sudo.log auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog root@ubuntu:~# service rsyslog restart rsyslog start/running, process 1384 |