sudo, ordinary users mention the right to operate, unauthorized tracking

Disclaimer: This article is a blogger original article, follow the CC 4.0 BY-SA copyright agreement, reproduced, please attach the original source link and this statement.

This link: https://blog.csdn.net/ck784101777/article/details/102547152

A user switching -su

Substitute User

su - [account name]

su - [Account Name] -C 'command'

1. Switch User

1. [root@proxy ~]#useradd jjh
2. [Root @ proxy ~] #su - jjh // root user is not required to enter a password through Cep
3. [jjh@proxy ~]$ whoami
4. jjh
5. [Jjh @ proxy ~] $ su - // switch accounts, default is switched to the root account
6. Password: // Enter the root password
7. [Root @ proxy ~] # whoami // confirm the results
8. root

2. Run switch user and

1. [Root @ proxy ~] # su - jjh -c "touch /tmp/test.txt" // administrator and ordinary users to create file switch
2. [root@proxy ~]# ll /tmp/test.txt
3. [root@proxy ~]#su - jjh
4. [Jjh @ proxy ~] $ su - -c "systemctl restart sshd" // administrator to restart the service, you need a password
5. password:
6. ● sshd.service - OpenSSH server daemon
7. Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
8. active: active (running) since 五 2018-01-19 08:59:40 CST; 1 months 4 days ago

3. Check the use su to switch

You can see which users use the su command to log the root account by viewing the log

[root@web1 ~]#cat /var/log/secure

...........

Oct 14 14:24:14 web1 su: pam_unix(su-l:session): session opened for user jjh by root(uid=0)
Oct 14 14:24:17 web1 su: pam_unix(su-l:session): session closed for user jjh

 

Second, the unauthorized operation -sudo

Supter of another do super execution

# sudo command to execute commands through sudo

View executable command sudo -l #

Sudo files modified in two ways:

visudo

vim /etc/sudoers

Empowering format:

Find / etc / 92 good sudoers of (command line input set nu show line numbers), you can see there is a configuration on the root

root    ALL=(ALL)       ALL

Format: user permissions = (execution in what capacity) [command of]

In ALL including the root, it is generally ALL = (ALL) can, Run command must be absolute path, as is actually performed useradd / usr / sbin / useradd

1. Allow softadm rights management systems and services

1) Modify / etc / sudoers configuration

Modify / etc / sudoers can directly edit the file using vim, or modify the file using visudo command.

Grant the user permissions to execute the relevant script, allowing to manage the system services through systemctl tool.

1. [root@proxy ~]# useradd jjh
2. [Root @ proxy ~] # vim / etc / sudoers // After modifying the file, use the Force Save wq
3. .. ..
4. jjh ALL=(ALL) /usr/bin/systemctl         
5. // execute systemctl authorized softadm command as root (ALL including root)

2) switch to softadm user, and execute permissions to verify sudo

1. [root@proxy ~]# su - jjh
2. [Jjh @ proxy ~] $ sudo -l // permission to view
3. … …
4. [Sudo] password for jjh: // Enter the password softadm
5. (ALL) /usr/bin/systemctl
6.  
7. [Jjh @ proxy ~] $ systemctl start httpd start the service failed // without sudo
8. Authentication is required
9. .. ..
10. [Jjh @ proxy ~] $ sudo systemctl restart httpd // successfully start the service by sudo

2. To allow ordinary users to add by way sudo / delete / modify user account other than root

1) Modify / etc / sudoers configuration

User management for the user to grant permission to execute related commands, we can use wildcard matching similar useradd, userdel and so the first few characters of the command. ! Represents the inverse of the right to disable the execution of an order. We do not want unauthorized operation when the threat to the root user, you need to disable the implementation of the right to the root

1. [Root @ proxy ~] # useradd jjh // add users
2. [Root @ proxy ~] # which useradd // see the actual script execution command
3. /usr/sbin/useradd
4. [root@proxy ~]# vim /etc/sudoers
5. .. ..
6. useradm ALL=(ALL)  /usr/bin/passwd,!/usr/bin/passwd root,/usr/sbin/user*,!/usr/sbin/user*  root

2) switching a common user authentication authority sudo

Can be added by way sudo / delete / modify the average user:

1. [root@proxy ~]# su - jjh
2. [Jjh @ proxy ~] $ sudo -l // useradm user can run the following command on the host:
3. .. ..
4. (root) /usr/bin/passwd, !/usr/bin/passwd root, /usr/sbin/user*,
5. !/usr/sbin/user* * root
6. [Jjh @ proxy ~] $ sudo useradd newuser01 // can add users
7. [Jjh @ proxy ~] $ sudo passwd newuser01 // ordinary user can modify the password
8. Jjh change the user's password.
9. New Password:
10. Re-enter the new password:
11. passwd: all authentication tokens have been successfully updated.

But can not change the root password (you can try to negate the operation was canceled, if you can change the root password):

1. [useradm@proxy ~]$ sudo passwd root
2. Sorry, you have no right useradm in as root on localhost
3. Execute / usr / bin / passwd root.

3. Allow the wheel group members to execute privileged commands all

This case is used to demonstrate the convenience of sudo and the dangers of improperly set, used with caution in a production environment.

1. [root@proxy ~]# vim /etc/sudoers　　　　　　//98行
2. .. ..
3. %wheel ALL=(ALL) ALL
4. [root@proxy ~]# usermod -a -G wheel jjh
5. [root@proxy ~]#su - jjh
6. [jjh@proxy ~]$ sudo -l
7. .. ..
8. Jjh user can run the following command on the host:
9. (root) /bin/*

4. sudo enable logging mechanism to perform the tracking operation sudo

1) Modify / etc / sudoers configuration, adding the log settings

1. [root@proxy ~]# visudo
2. Defaults logfile="/var/log/sudo"
3. .. ..

2) perform sudo operations to root (by default have all permissions)

1. [root@proxy ~]# su  - jjh
2. [jjh@proxy ~]$ sudo -l
3. [Jjh @ proxy ~] $ sudo -l // View authorized sudo operations
4. [Softadm @ proxy ~] # sudo systemctl status httpd // View authorized sudo operations

3) Confirm logging in force

1. [root@proxy ~]# tail /var/log/sudo
2. .. ..
3. May 16 22:14:49 : root : TTY=pts/1 ; PWD=/root ; USER=root ; COMMAND=list
4. Feb. 22 22:35:43: softadm: ​​TTY = pts / 11; PWD = / home / softadm; USER = root;
5. COMMAND=/bin/systemctl status httpd