/etc/sudoers files allows particular users or groups to run various commands as he root user, without needing the root password. This is useful for delegating roles and permissions to other users without sharing the root password. This file must be edited with the visudo command. Login as the root user and enter:
# visudoAppend the following line:
## Allows people in group admin to run all commandsSave and close the file. Finally, add a group called admin:
%admin ALL=(ALL) ALL
# groupadd adminAdd a user called vivek (existing user) to group admin:
# usermod -a -G admin vivekVerify group membership:
# id vivekSample Outputs:
uid=5001(vivek) gid=5001(vivek) groups=5001(vivek),10(admin)Login as user vivek and to run any command as the root type:
$ sudo /etc/init.d/httpd restartTo gain root shell, enter:
$ sudo -sWhen prompted for a password, enter vivek's password.
How Do I Keep Track Of All Users In Admin Group?
sudo can log both successful and unsuccessful attempts (as well as errors) to syslog (default is /var/log/secure), a log file, or both. By default sudo will log via syslog but this is changeable at configure time or via the sudoers file.# tail -f /var/log/secure
# grep something /var/log/securePlease note that sudo will normally only log the command it explicitly runs. If a user runs a command such as sudo su or sudo sh, subsequent commands run from that shell will not be logged, nor will sudo’s access control affect them. The same is true for commands that offer shell escapes (including most editors).
No comments:
Post a Comment