Linux运维学习作业1-sudo命令授权

要求：user1用户在本地以root运行命令cat 来浏览/etc/shadow文件

 

1、创建用户user1

[root@localhost ~]# ls -l /home/
total 0
[root@localhost ~]# 
[root@localhost ~]# cat /etc/passwd | tail -n 3
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
[root@localhost ~]#

[root@localhost ~]# useradd user1

[root@localhost ~]# ls -l /home/
total 0
drwx------. 2 user1 user1 62 Mar 15 10:14 user1
[root@localhost ~]# 
[root@localhost ~]# cat /etc/passwd | tail -n 3
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
user1:x:1000:1000::/home/user1:/bin/bash
[root@localhost ~]#

2、给用户user1创建密码

[root@localhost ~]# cat /etc/shadow | tail -n 1
user1:!!:17970:0:99999:7:::
[root@localhost ~]#

[root@localhost ~]# echo "123456" | passwd user1 --stdin
Changing password for user user1.
passwd: all authentication tokens updated successfully.
[root@localhost ~]# 

[root@localhost ~]# cat /etc/shadow | tail -n 1
user1:$6$JnHEKMLj$iFHeY03Dk/tPwi4co6c5U.7q1PgVwncu.IifsfXeqbEYADWVdPbwfeZjLwVcvElOq6OvyBrViRnuIDA7OBEKO/:17970:0:99999:7:::
[root@localhost ~]# 

3、给user1用户授权超级用户的cat命令

 

user1用户无权限访问/etc/shadow
[user1@localhost ~]$ cat /etc/shadow
cat: /etc/shadow: Permission denied
[user1@localhost ~]$

查找cat命令的位置
[root@localhost ~]# which cat
/bin/cat
[root@localhost ~]#

 

使用visudo命令编辑/etc/sudoers文件
[root@localhost ~]# visudo

......
......
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
user1   localhost=(root)        /bin/cat

## Allows members of the 'sys' group to run networking, software,
......
......

成功查看

[user1@localhost ~]$ sudo cat /etc/shadow

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for user1: 
root:$6$KTn2oHNUmW8G0z12$Wss6GGGmym69i.OkC6dS91.W9Bw8lw3Vyo6rppmiWSNBI/K2QbxT.GVlUD7MyaoCAi5ybyud02cZb/JkA0Go/.::0:99999:7:::
bin:*:16925:0:99999:7:::
daemon:*:16925:0:99999:7:::
adm:*:16925:0:99999:7:::
......
......