Ubuntu中普通用户sudo执行权限配置

发表时间:2015-05-11 11:43 | 分类:Linux | 浏览:554 次

sudo是linux下常用的允许普通用户使用超级用户权限的工具。默认Ubuntu关闭root登陆,用户可以通过sudo -i切换到root 。如果只允许www用户重启apache服务,那么可以通过配置/etc/sudoers实现。下面一起修改后就可以实现这个要求。

修改/etc/sudoers可以使用visudo编辑,好处是如果规则写的不符合要求他能提示你,坏处是调出的是nano编辑器,甚为不顺手。这个看个人喜好,我用visudo -f /etc/sudoers 打开配置。

首先看下Ubuntu默认sudoers配置,内容如下所示。

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d

然后添加几个alias,这样在下面配置权限时,会方便一些,不用写大段大段的配置。

# Host alias specification
Host_Alias SERVER = 192.168.188.115
# User alias specification
User_Alias USER_FLAG = www,tomcat
# Cmnd alias specification
Cmnd_Alias RESTARTAPACHE = service apache2 restart
Cmnd_Alias STOPAPACHE = service apache2 stop
Cmnd_Alias STARTAPACHE = service apache2 start

接着配置执行的权限。

# User privilege specification
root ALL=(ALL:ALL) ALL
USER_FLAG SERVER=RESTARTAPACHE,STOPAPACHE,STARTAPACHE

最后添加log日志记录,可以记录每个用户sudo执行日志。

Defaults@SERVER log_host, logfile=/var/log/sudo.log

查看配置效果:

root@ubuntu:~# su - tomcat
tomcat@ubuntu:~$ sudo service apache2 stop
[sudo] password for tomcat: 
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
tomcat@ubuntu:~$ ps -ef|grep apache
tomcat 26247 1 0 07:53 ? 00:01:38 /usr/lib/jvm/jdk1.7.0_45//bin/java -Djava.util.logging.config.file=/usr/local/tomcat7/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -server -Xms800M -Xmx1024M -XX:MaxPermSize=512M -Dfile.encoding=utf-8 -Djava.endorsed.dirs=/usr/local/tomcat7/endorsed -classpath /usr/local/tomcat7/bin/bootstrap.jar:/usr/local/tomcat7/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat7 -Dcatalina.home=/usr/local/tomcat7 -Djava.io.tmpdir=/usr/local/tomcat7/temp org.apache.catalina.startup.Bootstrap start
tomcat 27905 27848 0 11:35 pts/0 00:00:00 grep apache
tomcat@ubuntu:~$ sudo service apache2 start
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
tomcat@ubuntu:~$ ps -ef|grep apache 
tomcat 26247 1 0 07:53 ? 00:01:38 /usr/lib/jvm/jdk1.7.0_45//bin/java -Djava.util.logging.config.file=/usr/local/tomcat7/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -server -Xms800M -Xmx1024M -XX:MaxPermSize=512M -Dfile.encoding=utf-8 -Djava.endorsed.dirs=/usr/local/tomcat7/endorsed -classpath /usr/local/tomcat7/bin/bootstrap.jar:/usr/local/tomcat7/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat7 -Dcatalina.home=/usr/local/tomcat7 -Djava.io.tmpdir=/usr/local/tomcat7/temp org.apache.catalina.startup.Bootstrap start
root 27910 1 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27911 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27912 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27913 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27914 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27915 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
tomcat 27917 27848 0 11:35 pts/0 00:00:00 grep apache
tomcat@ubuntu:~$ sudo -i
Sorry, user tomcat is not allowed to execute '/bin/bash' as root on ubuntu.
tomcat@ubuntu:~$ logout
root@ubuntu:~# more /var/log/sudo.log 
May 11 11:35:42 : tomcat : HOST=ubuntu : TTY=pts/0 ; PWD=/home/tomcat ;
 USER=root ; COMMAND=service apache2 stop
May 11 11:35:49 : tomcat : HOST=ubuntu : TTY=pts/0 ; PWD=/home/tomcat ;
 USER=root ; COMMAND=service apache2 start
May 11 11:35:54 : tomcat : HOST=ubuntu : command not allowed ; TTY=pts/0 ;
 PWD=/home/tomcat ; USER=root ; COMMAND=/bin/bash

本文标签:,

本文链接:http://www.sijitao.net/1992.html

本文版权虫虫开源所有,欢迎您在本博客中留下评论,如需转载原创文章请注明出处,谢谢!

现在只有1个回复
Comment (1)
Trackbacks (0)
  1. 经典爱心  ( 2015.05.24 09:05 ) : #-9

    过来踩踩的 欢迎回访哦哈

    回复
  1. 还没有Trackbacks
icon_wink.gif icon_neutral.gif icon_mad.gif icon_twisted.gif icon_smile.gif icon_eek.gif icon_sad.gif icon_rolleyes.gif icon_razz.gif icon_redface.gif icon_surprised.gif icon_mrgreen.gif icon_lol.gif icon_idea.gif icon_biggrin.gif icon_evil.gif icon_cry.gif icon_cool.gif icon_arrow.gif icon_confused.gif icon_question.gif icon_exclaim.gif 

一键脚本 SSH攻击 IP查询 博客历程 留言本 文章归档 网站地图 谷歌地图
托管于阿里云&七牛云. 已加入博客联盟. 浙ICP备13025236号.
Copyright © 2010-2016 虫虫开源 All Rights Reserved.