在/etc/sudoers.d/中添加本地内容,而不是通过visudo直接修改sodoers文件


32

您能否将我引向/etc/sudoers.d/上的一些示例和更详细的说明

我想授予一些使用sudo命令的权限,但是要以适当的方式不要在多用户计算机上的Ubuntu安全模型中创建不必要的漏洞。

在远古时代,我做了一些简单的sudoers定制,但是现在/etc/sudoers.d/显然是一种更合适的方式,我想更好地理解它。

Answers:


43

就像这个问题所说的,它/etc/sudoers是一个系统范围的配置文件,可以通过系统升级自动更改,并且非常容易受到不正确的更改的影响。如果更改不当,您可能会失去访问权限或使系统无法启动。

$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#

(... some other content ...)

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

与您期望的相反,该#includedir指令不是comment。它的作用是导致sudo还读取和解析目录中的任何文件/etc/sudoers.d(不以“〜”结尾或包含“。”字符的文件)。

$ ls -l /etc/sud*
-r--r----- 1 root root  755 sty 20 17:03 /etc/sudoers

/etc/sudoers.d:
total 7
-r--r----- 1 root root 958 mar 30  2016 README
$ sudo cat /etc/sudoers.d/README
#
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
# 
#   #includedir /etc/sudoers.d
# 
# This will cause sudo to read and parse any files in the /etc/sudoers.d 
# directory that do not end in '~' or contain a '.' character.
# 
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
# 
# Note also, that because sudoers contents can vary widely, no attempt is 
# made to add this directive to existing sudoers files on upgrade.  Feel free
# to add the above directive to the end of your /etc/sudoers file to enable 
# this functionality for existing installations if you wish!
#
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo for more information.
#

与生存系统升级/etc/sudoers的内容不同,/etc/sudoers.d因此,最好在此处创建文件而不是对其进行修改/etc/sudoers

您可能要使用以下visudo命令编辑此目录中的文件:

$ sudo visudo -f /etc/sudoers.d/veracrypt
  GNU nano 2.5.3        File: /etc/sudoers.d/veracrypt.tmp                      

# Users in the veracryptusers group are allowed to run veracrypt as root.
%veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt

请注意,visudo可以使用不同的编辑器,而不是nano如在描述https://help.ubuntu.com/community/Sudoers

这里有一些我认为有用的链接:


4
文件中的错误/etc/sudoers.d并不能降低sudo 是不正确的。这些文件串联到/etc/sudoers。相同的规则适用于这些文件。
tobltobs 17-10-18

2
没错,您可以通过不适当的文件来关闭系统,尽管这样不太可能。#includedir不仅是一个简单的愚蠢的串联-尽管包括一些已完成的检查,所以将检测到最明显的错误并且您可以轻松地恢复。但是请当心-您总是会用锋利的刀子伤害自己,因此请谨慎对待;-)
Pawel Debski

By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.