Su and sudo

Su and sudo

1. su: Switch User
   

su -l user -c ‘COMMAND’

        

 

su -l root -c ‘COMMAND’

例如：

[root@repo ~]# useradd sutest

[root@repo ~]# echo ‘test’ | passwd –stdin sutest

Changing password for user sutest.

passwd: all authentication tokens updated successfully.

[root@repo ~]# useradd sutest1

[root@repo ~]# echo ‘test’ | passwd –stdin sutest1

Changing password for user sutest1.

passwd: all authentication tokens updated successfully.

[root@repo ~]# su -l sutest

[sutest@repo ~]$ su -l sutest1 -c ‘passwd’

Password:

Changing password for user sutest1.

Changing password for sutest1.

(current) UNIX password:

New password:

BAD PASSWORD: it is too short

su –l root

例如：

[sutest@repo ~]$ su -l root -c ‘passwd’

Password:

Changing password for user root.

New password:

BAD PASSWORD: it is based on a dictionary word

Retype new password:

passwd: all authentication tokens updated successfully.

[sutest@repo ~]$

1. sudo:
   

授权之后，能够让某用户以另外一个用户的身份运行命令；

配置文件：sudoers

        root    ALL=(ALL)     ALL

        %wheel    ALL=(ALL)    ALL

who: 运行命令者的身份，user

        where: 通过哪些主机，host

        (whom)：以哪个用户的身份, runas

        which: 运行哪些命令，command

 

配置项：

    users     hosts=(runas)     commands

 

    users:

        username

        #uid

        user_alias

        %group_name

        %#gid

 

    host:

        ip

        hostname

        netaddr

 

    command:

        command name

        directory

        sudoedit

 

    Alias_Type NAME = item1, item2, …

        NAME: 必须使用全大写字母；

    Alias_Type:

            User_Alias

            Host_Alias

            Runas_Alias

            Cmnd_Alias

 

            Cmnd_Alias USERADMINCMNDS = /usr/sbin/useradd, /usr/sbin/usermod, /usr/bin/passwd [a-z]*, !/usr/bin/passwd root

 

        # sudo [-u user] COMMAND

            -u user: 默认为root;

            -k: 清除此前记录用户密码；

例如：

[root@repo ~]# visudo

User_Alias JIAZI = sutest, sutest1

Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

Cmnd_Alias USERADMIN = /usr/bin/passwd [a-z]*, /usr/sbin/useradd, /usr/sbin/usermod, !/usr/bin/passwd root

JIAZI     ALL=(ALL) NOPASSWD: SOFTWARE

JIAZI ALL=(ALL) USERADMIN