The syntax for the su
command is this:
$ su option username arguments
The man page for su gives more details, but some highlights of the su command are as follows:
-c, --command COMMAND
pass a single COMMAND to the shell with -c
-m, --preserve-environment
do not reset environment variables
-l a full login simulation for the substituted user, the same as specifying the dash alone
You can invoke the su command in different ways that yield diverse results. By using su alone, you can become root, but you keep your regular user environment. You can verify this by using the printenv command before and after the change. Note that the working directory (you can execute pwd as a command line to print the current working directory) has not changed. By executing the following, you become root and inherit root's environ ment:
$ su -
By executing the following, you become that user and inherit the super user's environment — a pretty handy tool. (Remember: Inheriting the environment comes from using the dash in the command; omit that, and you keep your "old" environment.) To become another user, specify a different user's name on the command line:
$ su - other_user
When leaving an identity to return to your usual user identity, use the exit
command. For example, while logged on as a regular user, use this:
$ su -
The system prompts for a password:
Password:
When the password is entered correctly, the root user's prompt appears:
#
To return to the regular user's identity, just enter the following:
# exit
This takes you to the regular user's prompt:
$
If you need to allow other users access to certain commands with root privileges, it is necessary to give them the root password so that they can use su
— that definitely is not a secure solution. The next section describes a more flexible and secure method of allowing normal users to perform selected root tasks.
Granting Root Privileges on Occasion — The sudo
Command
It is often necessary to delegate some of the authority that root wields on a system. For a large system, this makes sense because no single individual will always be available to perform super-user functions. The problem is that UNIX permissions come with an all-or- nothing authority. Enter sudo
, an application that permits the assignment of one, several, or all of the root-only system commands.
After it is configured, using sudo
is simple. An authorized user merely precedes the command that requires super-user authority with the sudo
command, as follows:
$ sudo command
After getting the user's password, sudo
checks the /etc/sudoers
file to see whether that user is authorized to execute that particular command; if so, sudo
generates a "ticket" for a specific length of time that authorizes the use of that command. The user is then prompted for his password (to preserve accountability and provide some measure of security), and then the command is run as if root had issued it. During the life of the ticket, the command can be used again without a password prompt. If an unauthorized user attempts to execute a sudo
command, a record of the unauthorized attempt is kept in the system log and a mail message is sent to the super user.
Three man pages are associated with sudo
: sudo
, sudoers
, and visudo
. The first covers the command itself, the second the format of the /etc/sudoers
file, and the third the use of the special editor for /etc/sudoers
. You should use the special editing command because it checks the file for parse errors and locks the file to prevent others from editing it at the same time. The visudo
command uses the vi editor, so you might need a quick review of the vi
editing commands found in Chapter 4 in the section "Working with vi.
" You begin the editing by executing the visudo
command with this:
# visudo
The default /etc/sudoers
file looks like this:
# sudoers file.
#
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#
# Host alias specification
# User alias specification
# Cmnd alias specification
# Defaults specification
# User privilege specification
root ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL
# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now
The basic format of a sudoers
line in the file is as follows:
user host_computer=command
The user
can be an individual user or a group (prepended by a %
to identify the name as a group). The host_computer
is normally ALL
for all hosts on the network and localhost
for the local machine, but the host computer can be referenced as a subnet of any specific host. The command
in the sudoers
line can be ALL
, a list of specific commands, or a restriction on specific commands (formed by prepending a !
to the command). A number of options are available for use with the sudoers line, and aliases can be used to simplify the assignment of privileges. Again, the sudoers man page gives the details, but here are a few examples:
If you uncomment the line, as follows
# %wheel ALL=(ALL) ALL
any user you add to the wheel
group can execute any command after entering their specific password.
Suppose that you want to give user vanessa
permission across the network to be able to add users with the graphical interface. You would add the following line:
vanessa ALL=/system-config-users
Or perhaps you would grant permission only on her local computer:
vanessa 192.168.1.87=/usr/bin/system-config-users
If you want to give the editor group systemwide permission with no password required to delete files, you use this:
%editors ALL=NOPASSWD: /bin/rm
If you want to give every user permission with no password required to mount the CD drive on the localhost
, use the following:
ALL localhost=NOPASSWD:/sbin/mount /dev/scd0 /mnt/cdrom /sbin/umount /mnt/cdrom
It is also possible to use wildcards in the construction of the sudoers
file. Aliases can be used, as well, to make it easier to define users and groups. Although the man page for sudoers
contains some examples, http://www.komar.org/pres/sudo/toc.html provides illustrative notes and comments of sudo
use at a large aerospace company. The sudo
home page at http://www.sudo.ws/ is also a useful resource for additional explanations and examples.
The following command presents users with a list of the commands they are entitled to use:
Читать дальше