Linux命令-sudo

sudo命令用于给普通用户提供额外权利来完成原本只有超级用户才有权限完成的任务，

格式：sudo [参数] 命令名称

sudo命令与su命令的区别是，su命令允许普通用户完全变更为超级管理员的身份，但

如此一来便增加了安全隐患，而使用sudo命令可以仅将特定的命令/程序执行权限赋予

指定的用户。

sudo命令的特色：

：限制用户执行指定的命令
：记录用户执行的每一条命令
：验证过密码后5分钟（默认值）内无需再让用户验证密码，更加方便。

sudo程序的配置文件为/etc/sudoers，只有超级用户可以使用visudo编辑该文件。

实例1：使用visudo命令编辑sudo程序的配置文件，在第99行添加参数允许pentest用户

能够从任意主机执行任意命令的参数。

       ## Sudoers allows particular users to run various commands as
       ## the root user, without needing the root password.
       ##
       ## Examples are provided at the bottom of the file for collections
       ## of related commands, which can then be delegated out to particular
       ## users or groups.
       ##
       ## This file must be edited with the 'visudo' command.

      ## Host Aliases
      ## Groups of machines. You may prefer to use hostnames (perhaps using
      ## wildcards for entire domains) or IP addresses instead.
      # Host_Alias     FILESERVERS = fs1, fs2
      # Host_Alias     MAILSERVERS = smtp, smtp2

      ## User Aliases
      ## These aren't often necessary, as you can use regular groups
      ## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
      ## rather than USERALIAS
      # User_Alias ADMINS = jsmith, mikem

      ## Command Aliases
      ## These are groups of related commands...

      ## Networking
      # Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

      ## Installation and management of software
      # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

      ## Services
      # Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable

      ## Updating the locate database
      # Cmnd_Alias LOCATE = /usr/bin/updatedb

      ## Storage
      # Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

      ## Delegating permissions
      # Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp

      ## Processes
      # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

      ## Drivers
      # Cmnd_Alias DRIVERS = /sbin/modprobe

      # Defaults specification

      #
      # Disable "ssh hostname sudo <cmd>", because it will show the password in clear.
      #         You have to run "ssh -t hostname sudo <cmd>".
      #
      Defaults    requiretty

      #
      # Refuse to run if unable to disable echo on the tty. This setting should also be
      # changed in order to be able to use sudo without a tty. See requiretty above.
      #
      Defaults   !visiblepw

      #
      # Preserving HOME has security implications since many programs
      # use it when searching for configuration files. Note that HOME
      # is already set when the the env_reset option is enabled, so
      # this option is only effective for configurations where either
      # env_reset is disabled or HOME is present in the env_keep list.
      #
      Defaults    always_set_home

      Defaults    env_reset
      Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
      Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
      Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
      Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
      Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

      #
      # Adding HOME to env_keep may enable a user to run unrestricted
      # commands via sudo.
      #
      # Defaults   env_keep += "HOME"

      Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

      ## Next comes the main part: which users can run what software on
      ## which machines (the sudoers file can be shared between multiple
      ## systems).
      ## Syntax:
      ##
      ##      user    MACHINE=COMMANDS
      ##
      ## The COMMANDS section may have other options added to it.
      ##
      ## Allow root to run any commands anywhere
      root    ALL=(ALL)       ALL
      pentest ALL=(ALL)       ALL
     ## Allows members of the 'sys' group to run networking, software,
     ## service management apps and more.
     # %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

     ## Allows people in group wheel to run all commands
     %wheel  ALL=(ALL)       ALL

     ## Same thing without a password
     # %wheel        ALL=(ALL)       NOPASSWD: ALL

     ## Allows members of the users group to mount and unmount the
     ## cdrom as root
     # %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

     ## Allows members of the users group to shutdown this system
     # %users  localhost=/sbin/shutdown -h now

     ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
     #includedir /etc/sudoers.d
[root@localhost ~]#

切换到pentest用户查看可以执行的命令，提示为ALL，即可以执行所有超级管理员的命令。

[root@localhost ~]# su - pentest
上一次登录：五 9月   :: CST 2016pts/ 上
[pentest@localhost ~]$ sudo -l
[sudo] password for pentest:
匹配此主机上 pentest 的默认条目：
    requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME
    HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS
    LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
    env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
    LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

用户 pentest 可以在该主机上运行以下命令：
    (ALL) ALL

使用普通ls命令来查看/root文件夹出现“权限不够”，然后使用sudo ls后便可以查看了。

[pentest@localhost ~]$ ls /root/
ls: 无法打开目录/root/: 权限不够
[pentest@localhost ~]$ sudo ls /root/
[sudo] password for pentest:
anaconda-ks.cfg       testA  testC  公共  视频  文档  音乐
initial-setup-ks.cfg  testB  yum    模板  图片  下载  桌面
[pentest@localhost ~]$

实例2：仅允许pentest以root身份执行cat命令

pentest用户先以普通权限cat文件/etc/shadow发现权限不够
[pentest@localhost ~]$ cat /etc/shadow
cat: /etc/shadow: 权限不够

切换至root用户给予pentest用户cat权限
[pentest@localhost ~]$ su - root
密码：
上一次登录：五 9月   :: CST 2016pts/ 上
[root@localhost ~]# visudo
[root@localhost ~]# su - pentest
上一次登录：五 9月   :: CST 2016pts/1、 上

赋予执行cat权限
[root@localhost ~]# visudo
root    ALL=(ALL)       ALL
pentest ALL=(root)      /bin/cat

继续使用普通cat确认是否可以查看/etc/shadow提示权限不够
[pentest@localhost ~]$ cat /etc/shadow
cat: /etc/shadow: 权限不够

使用sudo cat查看/etc/shadow发现可以查看了。
[pentest@localhost ~]$ sudo cat /etc/shadow
root:$$Y6LHG5EEAGs3JMUM$jcEE.RZgMF9mO/xiPVA522l1Ek8JZ2Nkl.9nCBuiUWAH/.F84Kj6XyNxbuecW1M4BNGpryB/10Ncp.EGu9VhZ/:::::::
bin:*:::::::
daemon:*:::::::
adm:*:::::::
lp:*:::::::
sync:*:::::::
shutdown:*:::::::
halt:*:::::::
mail:*:::::::
operator:*:::::::
games:*:::::::
ftp:*:::::::
nobody:*:::::::
avahi-autoipd:!!:::::::
ods:!!:::::::
pegasus:!!:::::::
systemd-bus-proxy:!!:::::::
systemd-network:!!:::::::
dbus:!!:::::::
polkitd:!!:::::::
sssd:!!:::::::
colord:!!:::::::
apache:!!:::::::
tss:!!:::::::
unbound:!!:::::::
usbmuxd:!!:::::::
abrt:!!:::::::
amandabackup:!!:::::::
saslauth:!!:::::::
libstoragemgmt:!!:::::::
geoclue:!!:::::::
memcached:!!:::::::
rpc:!!:::::::
postfix:!!:::::::
setroubleshoot:!!:::::::
rtkit:!!:::::::
chrony:!!:::::::
mysql:!!:::::::
qemu:!!:::::::
ntp:!!:::::::
rpcuser:!!:::::::
nfsnobody:!!:::::::
radvd:!!:::::::
named:!!:::::::
pcp:!!:::::::
pulse:!!:::::::
hsqldb:!!:::::::
tomcat:!!:::::::
pkiuser:!!:::::::
gdm:!!:::::::
gnome-initial-setup:!!:::::::
avahi:!!:::::::
postgres:!!:::::::
dovecot:!!:::::::
dovenull:!!:::::::
sshd:!!:::::::
oprofile:!!:::::::
tcpdump:!!:::::::
pentest:$$6U3Z2n.sd63M32ZS$tzQJg852/1G3Mw7uv1.Ipbh.lOusvfd47Ih52xxku7okBBb/nu.Vn5V4mB50SSCMfaspqeGSDLcPM7XdgLE2w/:::::::
[pentest@localhost ~]$