Changes between Version 17 and Version 18 of TipAndDoc/Linux

Timestamp:

May 1, 2013 4:15:41 PM (13 years ago)

Author:

mitty

Comment:

--

TipAndDoc/Linux

@@ -37 +37 @@
    * # echo b > /proc/sysrq-trigger
 
+ = sudo =
  * [http://ubuntuforums.org/showthread.php?t=1132821 HowTO: Sudoers Configuration - Ubuntu Forums]
  > 2) Sudo reads the sudoers file and applies permissions in order from top to bottom. So the last line in the file will overwrite any previous conflict with the config settings. So it is best to put new configuration lines at the bottom.
+
+ * [http://nixcraft.com/networking-firewalls-security/15132-sudo-exclude-commands-disable-sudo-su-bash-shell.html (Solved) Sudo Exclude Commands And Disable: sudo su -, Bash Shell]
+ * 例えば、poweroff, reboot, shutdownコマンドをsudoからは扱えなくするには、以下の様に設定する
+  * /etc/sudoers.d/adm
+{{{
+Cmnd_Alias PWRCTL = /sbin/poweroff,/sbin/reboot,/sbin/shutdown
+%adm    ALL=NOPASSWD: ALL, !PWRCTL
+}}}
+  * mitty@test:~$ id mitty
+{{{
+uid=1001(mitty) gid=1001(mitty) groups=1001(mitty),4(adm)
+}}}
+  * mitty@test:~$ sudo shutdown
+{{{
+Sorry, user mitty is not allowed to execute '/sbin/shutdown' as root on test.
+}}}
+  * mitty@test:~$ sudo reboot
+{{{
+Sorry, user mitty is not allowed to execute '/sbin/reboot' as root on test.
+}}}
+  * mitty@test:~$ sudo poweroff
+{{{
+Sorry, user mitty is not allowed to execute '/sbin/poweroff' as root on test.
+}}}
+ * 禁止されているコマンドを実行する際は、{{{sudo su -}}}などして別のgroupになってから行う
 
  = Swap =