### sudo 臨時擁有一些權限 使用sudo可以使普通賬戶不用知道root的密碼而臨時擁有root的權限，這是為了提高安全性，不可登錄。 某個用戶從哪一臺主機以某個用戶身份執行某一個命令 有效期限五分鐘 ~~~ which users can run what software on which machines 格式 who which_host=(runas) command ~~~ ~~~ User_Alias NAME = MEMBER1，MEMBER2，... 用戶名；%組名；其他User_Alias Host_Alias NAME = HOST1，HOST2，... 主機名；IP；網絡地址；其他Host_Alias Runas_Alias NAME = MEMBER1，MEMBER2，... 用戶名；%組名；其他Runas_Alias Cmnd_Alias CMD = CMD1，CMD2，... 命令最好使用絕對路徑，可以是目錄 ~~~ ~~~ # User alias specification User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias WEBMASTERS = will, wendy, wim # Runas alias specification Runas_Alias OP = root, operator Runas_Alias DB = oracle, sybase Runas_Alias ADMINGRP = adm, oper # Host alias specification Host_Alias SPARC = bigtime, eclipse, moet, anchor :\ SGI = grolsch, dandelion, black :\ ALPHA = widget, thalamus, foobar :\ HPPA = boa, nag, python Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 Host_Alias SERVERS = master, mail, www, ns Host_Alias CDROM = orion, perseus, hercules # Cmnd alias specification Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\ /usr/sbin/restore, /usr/sbin/rrestore Cmnd_Alias KILL = /usr/bin/kill Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown Cmnd_Alias HALT = /usr/sbin/halt Cmnd_Alias REBOOT = /usr/sbin/reboot Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \ /usr/local/bin/tcsh, /usr/bin/rsh, \ /usr/local/bin/zsh Cmnd_Alias SU = /usr/bin/su Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less ~~~ 讓普通用戶擁有root用戶的權限，但是不能修改root用戶的密碼 ~~~ User_Alias DEV = tom Cmnd_Alias NOTCHANGEPASSWD = !/usr/bin/passwd,/usr/bin/passwd [A-Za-z]*,!/usr/bin/passwd root ## Allow root to run any commands anywhere root ALL=(ALL) ALL DEV ALL=(root) NOPASSWD:ALL,NOTCHANGEPASSWD ~~~ ### visudo visudo -f sudoers 指定sudoers文件 sudo -l 查看普通用戶在sudo下有哪些權限 su -k 每次執行都必須輸入密碼 visudo 命令去編輯相關的配置文件/etc/sudoers（440）. 如果沒有visudo這個命令，請使用 yum install -y sudo 安裝 ~~~ ## Allow root to run any commands anywhere root ALL=(ALL) ALL test 192.168.8.1/24=(root) NOPASSWD:/bin/ls,/usr/bin/passwd test1 ALL=(root) /bin/ls,/usr/bin/passwd ~~~ 可以限制IP和命令