Configure Sudo
2014/08/01 |
Configure sudo to separate users' duty if some people share privileges.
It's not necessarry to install some packages because Sudo packages is already installed even if you installed CentOS with [Minimal].
|
|
[1] | Transfer root privilege to a user all. |
[root@dlp ~]#
# add follows to the end: "cent" can use all root privilege cent ALL=(ALL) ALL # how to write ⇒ destination host=(owner) command
# make sure with user "cent" [cent@dlp ~]$ /sbin/shutdown -r now shutdown: Need to be root # denied normally [cent@dlp ~]$
Password:
The system is going down for reboot NOW! # own password # just executed
|
[2] | In addition to the setting [1], set that some commands are not allowed. |
[root@dlp ~]#
# near line 49: add aliase for the kind of shutdown commands Cmnd_Alias SHUTDOWN = /sbin/halt, /sbin/shutdown, \
/sbin/poweroff, /sbin/reboot, /sbin/init # add ( commands in aliase 'SHUTDOWN' are not allowed ) cent ALL=(ALL) ALL,
!SHUTDOWN # make sure with user "cent" [cent@dlp ~]$ Sorry, user cent is not allowed to execute '/sbin/shutdown -r now' as root on dlp.srv.world. # denied normally
|
[3] | Transfer some commands with root privilege to users in a group. |
[root@dlp ~]#
# near line 51: add aliase for the kind of user management comamnds Cmnd_Alias USERMGR = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod, \
/usr/bin/passwd # add follows to the end %usermgr ALL=(ALL) USERMGR
# make sure with user "cent" [cent@dlp ~]$ [cent@dlp ~]$ # done normally [cent@dlp ~]$ Changing password for user testuser. New UNIX password: # set testuser's password Retype new UNIX password: passwd: all authentication tokens updated successfully. |
[4] | Transfer a command with root privilege to a user. |
[root@dlp ~]#
# add follows to the end cent ALL=(ALL) /usr/sbin/visudo fedora ALL=(ALL) /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod, /usr/bin/passwd ubuntu ALL=(ALL) /bin/vi # make sure with user "cent" # possible to open and edit ## Sudoers allows particular users to run various commands as ## the root user, without needing the root password. ## # make sure with user "fedora" [fedora@dlp ~]$
[fedora@dlp ~]$
# done normally # make sure with user "ubuntu" # possible to open and edit # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that |
[5] | The logs for sudo are kept in '/var/log/secure', but there are many kind of logs in it. So if you'd like to keep only sudo's log in a file, Set like follows. |
[root@dlp ~]#
# add to the end Defaults syslog=local1
[root@dlp ~]#
vi /etc/rsyslog.conf # line 42: add like follows *.info;mail.none;authpriv.none;cron.none ;local1.none /var/log/messageslocal1.* /var/log/sudo.log /etc/rc.d/init.d/rsyslog restart Shutting down system logger: [ OK ] Starting system logger: [ OK ] |