Ubuntu中普通用户sudo执行权限配置

sudo是linux下常用的允许普通用户使用超级用户权限的工具。默认Ubuntu关闭root登陆，用户可以通过sudo -i切换到root 。如果只允许www用户重启apache服务，那么可以通过配置/etc/sudoers实现。下面一起修改后就可以实现这个要求。

修改/etc/sudoers可以使用visudo编辑，好处是如果规则写的不符合要求他能提示你，坏处是调出的是nano编辑器，甚为不顺手。这个看个人喜好，我用visudo -f /etc/sudoers 打开配置。

首先看下Ubuntu默认sudoers配置，内容如下所示。

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d

然后添加几个alias，这样在下面配置权限时，会方便一些，不用写大段大段的配置。

# Host alias specification
Host_Alias SERVER = 192.168.188.115
# User alias specification
User_Alias USER_FLAG = www,tomcat
# Cmnd alias specification
Cmnd_Alias RESTARTAPACHE = service apache2 restart
Cmnd_Alias STOPAPACHE = service apache2 stop
Cmnd_Alias STARTAPACHE = service apache2 start

接着配置执行的权限。

# User privilege specification
root ALL=(ALL:ALL) ALL
USER_FLAG SERVER=RESTARTAPACHE,STOPAPACHE,STARTAPACHE

最后添加log日志记录，可以记录每个用户sudo执行日志。

Defaults@SERVER log_host, logfile=/var/log/sudo.log

查看配置效果：

root@ubuntu:~# su - tomcat
tomcat@ubuntu:~$ sudo service apache2 stop
[sudo] password for tomcat: 
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
tomcat@ubuntu:~$ ps -ef|grep apache
tomcat 26247 1 0 07:53 ? 00:01:38 /usr/lib/jvm/jdk1.7.0_45//bin/java -Djava.util.logging.config.file=/usr/local/tomcat7/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -server -Xms800M -Xmx1024M -XX:MaxPermSize=512M -Dfile.encoding=utf-8 -Djava.endorsed.dirs=/usr/local/tomcat7/endorsed -classpath /usr/local/tomcat7/bin/bootstrap.jar:/usr/local/tomcat7/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat7 -Dcatalina.home=/usr/local/tomcat7 -Djava.io.tmpdir=/usr/local/tomcat7/temp org.apache.catalina.startup.Bootstrap start
tomcat 27905 27848 0 11:35 pts/0 00:00:00 grep apache
tomcat@ubuntu:~$ sudo service apache2 start
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
tomcat@ubuntu:~$ ps -ef|grep apache 
tomcat 26247 1 0 07:53 ? 00:01:38 /usr/lib/jvm/jdk1.7.0_45//bin/java -Djava.util.logging.config.file=/usr/local/tomcat7/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -server -Xms800M -Xmx1024M -XX:MaxPermSize=512M -Dfile.encoding=utf-8 -Djava.endorsed.dirs=/usr/local/tomcat7/endorsed -classpath /usr/local/tomcat7/bin/bootstrap.jar:/usr/local/tomcat7/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat7 -Dcatalina.home=/usr/local/tomcat7 -Djava.io.tmpdir=/usr/local/tomcat7/temp org.apache.catalina.startup.Bootstrap start
root 27910 1 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27911 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27912 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27913 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27914 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
www 27915 27910 0 11:35 ? 00:00:00 /usr/local/apache2/bin/httpd -k start
tomcat 27917 27848 0 11:35 pts/0 00:00:00 grep apache
tomcat@ubuntu:~$ sudo -i
Sorry, user tomcat is not allowed to execute '/bin/bash' as root on ubuntu.
tomcat@ubuntu:~$ logout
root@ubuntu:~# more /var/log/sudo.log 
May 11 11:35:42 : tomcat : HOST=ubuntu : TTY=pts/0 ; PWD=/home/tomcat ;
 USER=root ; COMMAND=service apache2 stop
May 11 11:35:49 : tomcat : HOST=ubuntu : TTY=pts/0 ; PWD=/home/tomcat ;
 USER=root ; COMMAND=service apache2 start
May 11 11:35:54 : tomcat : HOST=ubuntu : command not allowed ; TTY=pts/0 ;
 PWD=/home/tomcat ; USER=root ; COMMAND=/bin/bash