visudo 里想设置所有用户可以用 sudo 执行某个命令怎么设置?

clino

我看了 https://help.ubuntu.com/community/Sudoers
里面的格式是
<user list> <host list> = <operator list> <tag list> <command list>
user list 比较好理解,但是想设成所有用户是不是用ALL
host list,operator list,tag list 这3个怎么理解?

我想这么设可以吧:
ALL ALL = (ALL) /usr/local/bin/somecmd

如果想设成不用输密码应该是这样吧:
ALL ALL = (ALL) NOPASSWD: /usr/local/bin/somecmd

主要还想问一下host list,operator list,tag list 这3个怎么理解?因为涉及到安全,所以想尽量搞清楚

ulovko

user  from=(switch to ?)  switch后可以使用的command

clino

ulovko 发表于 2012-05-25 11:55
user  from=(switch to ?)  switch后可以使用的command

呃...完全没看懂...

ulovko

回复 3# clino


    小声告诉你个秘密！

1. 
   
2. >man sudoers
   
3. EXAMPLES
   
4.        Below are example sudoers entries.  Admittedly, some of these are a bit
   
5.        contrived.  First, we allow a few environment variables to pass and
   
6.        then define our aliases:
   
7. 
   
8.         # Run X applications through sudo; HOME is used to find the
   
9.         # .Xauthority file.  Note that other programs use HOME to find
   
10.         # configuration files and this may lead to privilege escalation!
    
11.         Defaults env_keep += "DISPLAY HOME"
    
12. 
    
13.         # User alias specification
    
14.         User_Alias     FULLTIMERS = millert, mikef, dowdy
    
15.         User_Alias     PARTTIMERS = bostley, jwfox, crawl
    
16.         User_Alias     WEBMASTERS = will, wendy, wim
    
17. 
    
18.         # Runas alias specification
    
19.         Runas_Alias    OP = root, operator
    
20.         Runas_Alias    DB = oracle, sybase
    
21.         Runas_Alias    ADMINGRP = adm, oper
    
22. 
    
23.         # Host alias specification
    
24.         Host_Alias     SPARC = bigtime, eclipse, moet, anchor :\
    
25.                        SGI = grolsch, dandelion, black :\
    
26.                        ALPHA = widget, thalamus, foobar :\
    
27.                        HPPA = boa, nag, python
    
28.         Host_Alias     CUNETS = 128.138.0.0/255.255.0.0
    
29.         Host_Alias     CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
    
30.         Host_Alias     SERVERS = master, mail, www, ns
    
31.         Host_Alias     CDROM = orion, perseus, hercules
    
32. 
    
33.         # Cmnd alias specification
    
34.         Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
    
35.                                /usr/sbin/restore, /usr/sbin/rrestore
    
36.         Cmnd_Alias     KILL = /usr/bin/kill
    
37.         Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm
    
38.         Cmnd_Alias     SHUTDOWN = /usr/sbin/shutdown
    
39.         Cmnd_Alias     HALT = /usr/sbin/halt
    
40.         Cmnd_Alias     REBOOT = /usr/sbin/reboot
    
41.         Cmnd_Alias     SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
    
42.                                 /usr/local/bin/tcsh, /usr/bin/rsh, \
    
43.                                 /usr/local/bin/zsh
    
44.         Cmnd_Alias     SU = /usr/bin/su
    
45.         Cmnd_Alias     PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
    
46. 
    
47.        Here we override some of the compiled in default values.  We want sudo
    
48.        to log via syslog(3) using the auth facility in all cases.  We don't
    
49.        want to subject the full time staff to the sudo lecture, user millert
    
50.        need not give a password, and we don't want to reset the LOGNAME, USER
    
51.        or USERNAME environment variables when running commands as root.
    
52.        Additionally, on the machines in the SERVERS Host_Alias, we keep an
    
53.        additional local log file and make sure we log the year in each log
    
54.        line since the log entries will be kept around for several years.
    
55.        Lastly, we disable shell escapes for the commands in the PAGERS
    
56.        Cmnd_Alias (/usr/bin/more, /usr/bin/pg and /usr/bin/less).
    
57. 
    
58.         # Override built-in defaults
    
59.         Defaults               syslog=auth
    
60.         Defaults>root          !set_logname
    
61.         Defaults:FULLTIMERS    !lecture
    
62.         Defaults:millert       !authenticate
    
63.         Defaults@SERVERS       log_year, logfile=/var/log/sudo.log
    
64.         Defaults!PAGERS        noexec
    
65. 
    
66.        The User specification is the part that actually determines who may run
    
67.        what.
    
68. 
    
69.         root           ALL = (ALL) ALL
    
70.         %wheel         ALL = (ALL) ALL
    
71. 
    
72.        We let root and any user in group wheel run any command on any host as
    
73.        any user.
    
74. 
    
75.         FULLTIMERS     ALL = NOPASSWD: ALL
    
76. 
    
77.        Full time sysadmins (millert, mikef, and dowdy) may run any command on
    
78.        any host without authenticating themselves.
    
79. 
    
80.         PARTTIMERS     ALL = ALL
    
81. 
    
82.        Part time sysadmins (bostley, jwfox, and crawl) may run any command on
    
83.        any host but they must authenticate themselves first (since the entry
    
84.        lacks the NOPASSWD tag).
    
85. 
    
86.         jack           CSNETS = ALL
    
87. 
    
88.        The user jack may run any command on the machines in the CSNETS alias
    
89.        (the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0).  Of
    
90.        those networks, only 128.138.204.0 has an explicit netmask (in CIDR
    
91.        notation) indicating it is a class C network.  For the other networks
    
92.        in CSNETS, the local machine's netmask will be used during matching.
    
93. 
    
94.         lisa           CUNETS = ALL
    
95. 
    
96.        The user lisa may run any command on any host in the CUNETS alias (the
    
97.        class B network 128.138.0.0).
    
98. 
    
99.         operator       ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
    
100.                        sudoedit /etc/printcap, /usr/oper/bin/
     
101. 
     
102.        The operator user may run commands limited to simple maintenance.
     
103.        Here, those are commands related to backups, killing processes, the
     
104.        printing system, shutting down the system, and any commands in the
     
105.        directory /usr/oper/bin/.
     
106. 
     
107.         joe            ALL = /usr/bin/su operator
     
108. 
     
109.        The user joe may only su(1) to operator.
     
110. 
     
111.         pete           HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
     
112. 
     
113.         %opers         ALL = (: ADMINGRP) /usr/sbin/
     
114. 
     
115.        Users in the opers group may run commands in /usr/sbin/ as themselves
     
116.        with any group in the ADMINGRP Runas_Alias (the adm and oper groups).
     
117. 
     
118.        The user pete is allowed to change anyone's password except for root on
     
119.        the HPPA machines.  Note that this assumes passwd(1) does not take
     
120.        multiple user names on the command line.
     
121. 
     
122.         bob            SPARC = (OP) ALL : SGI = (OP) ALL
     
123. 
     
124.        The user bob may run anything on the SPARC and SGI machines as any user
     
125.        listed in the OP Runas_Alias (root and operator).
     
126. 
     
127.         jim            +biglab = ALL
     
128. 
     
129.        The user jim may run any command on machines in the biglab netgroup.
     
130.        sudo knows that "biglab" is a netgroup due to the '+' prefix.
     
131. 
     
132.         +secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
     
133. 
     
134.        Users in the secretaries netgroup need to help manage the printers as
     
135.        well as add and remove users, so they are allowed to run those commands
     
136.        on all machines.
     
137. 
     
138.         fred           ALL = (DB) NOPASSWD: ALL
     
139. 
     
140.        The user fred can run commands as any user in the DB Runas_Alias
     
141.        (oracle or sybase) without giving a password.
     
142. 
     
143.         john           ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
     
144. 
     
145.        On the ALPHA machines, user john may su to anyone except root but he is
     
146.        not allowed to specify any options to the su(1) command.
     
147. 
     
148.         jen            ALL, !SERVERS = ALL
     
149. 
     
150.        The user jen may run any command on any machine except for those in the
     
151.        SERVERS Host_Alias (master, mail, www and ns).
     
152. 
     
153.         jill           SERVERS = /usr/bin/, !SU, !SHELLS
     
154. 
     
155.        For any machine in the SERVERS Host_Alias, jill may run any commands in
     
156.        the directory /usr/bin/ except for those commands belonging to the SU
     
157.        and SHELLS Cmnd_Aliases.
     
158. 
     
159.         steve          CSNETS = (operator) /usr/local/op_commands/
     
160. 
     
161.        The user steve may run any command in the directory
     
162.        /usr/local/op_commands/ but only as user operator.
     
163. 
     
164.         matt           valkyrie = KILL
     
165. 
     
166.        On his personal workstation, valkyrie, matt needs to be able to kill
     
167.        hung processes.
     
168. 
     
169.         WEBMASTERS     www = (www) ALL, (root) /usr/bin/su www
     
170. 
     
171.        On the host www, any user in the WEBMASTERS User_Alias (will, wendy,
     
172.        and wim), may run any command as user www (which owns the web pages) or
     
173.        simply su(1) to www.
     
174. 
     
175.         ALL            CDROM = NOPASSWD: /sbin/umount /CDROM,\
     
176.                        /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
     
177. 
     
178.        Any user may mount or unmount a CD-ROM on the machines in the CDROM
     
179.        Host_Alias (orion, perseus, hercules) without entering a password.
     
180.        This is a bit tedious for users to type, so it is a prime candidate for
     
181.        encapsulating in a shell script.
     
182. 
     
183. SECURITY NOTES
     
184.        It is generally not effective to "subtract" commands from ALL using the
     
185.        '!' operator.  A user can trivially circumvent this by copying the
     
186.        desired command to a different name and then executing that.  For
     
187.        example:
     
188. 
     
189.            bill        ALL = ALL, !SU, !SHELLS
     
190. 
     
191.        Doesn't really prevent bill from running the commands listed in SU or
     
192.        SHELLS since he can simply copy those commands to a different name, or
     
193.        use a shell escape from an editor or other program.  Therefore, these
     
194.        kind of restrictions should be considered advisory at best (and
     
195.        reinforced by policy).
     
196. 
     
197.        Furthermore, if the fast_glob option is in use, it is not possible to
     
198.        reliably negate commands where the path name includes globbing (aka
     
199.        wildcard) characters.  This is because the C library's fnmatch(3)
     
200.        function cannot resolve relative paths.  While this is typically only
     
201.        an inconvenience for rules that grant privileges, it can result in a
     
202.        security issue for rules that subtract or revoke privileges.
     
203. 
     
204.        For example, given the following sudoers entry:
     
205. 
     
206.         john   ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,
     
207.              /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
     
208. 
     
209.        User john can still run /usr/bin/passwd root if fast_glob is enabled by
     
210.        changing to /usr/bin and running ./passwd root instead.
     
211. 
     
212. 
     

复制代码

zjhxmjl

clino 发表于 2012-05-25 11:31
我看了 https://help.ubuntu.com/community/Sudoers
里面的格式是
  =   

方法很简单：

1. ALL ALL=NOPASSWD: /path/to/command

复制代码

the host list is a list of hosts or a host alias（服务器列表）
the operator list is a list of users they must be running as or a runas alias
the command list is a list of commands or a cmnd alias.
其实下面都有相应的实例：

1. # This lets the webmasters run all the web commands on the machine
   
2. # "webserver" provided they give a password
   
3. WEBMASTERS webserver= WEB_CMDS
   
4. # This lets the admins run all the admin commands on the servers
   
5. ADMINS SERVERS= ADMIN_CMDS
   
6. # This lets all the USERS run admin commands on the workstations provided
   
7. # they give the root password or and admin password (using "sudo -u <username>")
   
8. USERS WORKSTATIONS=(ADMINS) ADMIN_CMDS
   
9. # This lets "harry" shutdown his own machine without a password
   
10. harry harrys-machine= NOPASSWD: SHUTDOWN_CMDS
    
11. # And this lets everybody print without requiring a password
    
12. ALL ALL=(ALL) NOPASSWD: PRINTING_CMDS

复制代码

参考资料