s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

sudo

Run a command as root (or another user) with your own password, if the sudo rules allow it.

المستوى
امتحان RHCSA
المجموعة
المستخدمون والمجموعات
يحتاج root
للتغييرات
الحزمة
sudo
يُسمّى أيضًا
sudoedit

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

sudo checks the rules in /etc/sudoers and /etc/sudoers.d/. When a rule allows you, it asks for your password (not root's) and runs the command. After that it remembers you for some minutes (on RHEL 5 minutes per terminal).

Every use is logged with your real name (in /var/log/secure and the journal). This makes sudo safer than a shared root password, and with small rules you can give people only the commands they need (least privilege).

On RHEL, members of the group wheel may run every command. sudoedit (= sudo -e) edits a file safely with your own editor.

طريقة الكتابة

sudo [OPTION]... COMMAND [ARGUMENT]...
sudo -i | -s [COMMAND]
sudo -l [-U USER] [COMMAND]
sudo -e FILE...
sudo -v | -k | -K

الخيارات 31

الأكثر استخدامًا

Run commands

-u, --user=USER
Run as this user instead of root.
-g, --group=GROUP
Run with this primary group.
-i, --login
Start a login shell of the target user (like su -).
-s, --shell
Start the shell from $SHELL (keeps more of your environment).
-E, --preserve-env
Keep your environment variables (if the rules allow it).
--preserve-env=LIST
Keep only these variables.
-H, --set-home
Set HOME to the home folder of the target user (default on RHEL).
-D, --chdir=DIR
Run the command in this folder (if allowed).
-R, --chroot=DIR
Change the root folder before running (if allowed).
-b, --background
Run the command in the background.
-P, --preserve-groups
Keep your own group list.
-C, --close-from=NUM
Close all open files from number NUM up.
-T, --command-timeout=TIME
Stop the command after this time (if allowed).
-r, --role=ROLE
SELinux role for the command.
-t, --type=TYPE
SELinux type for the command.
--,
End of sudo options; the rest belongs to the command.

Edit files

-e, --edit
Edit files as sudoedit: a temporary copy is opened in your editor, then copied back.

Check rules

-l, --list
Show what you may run (with a command: check that one).
-U, --other-user=USER
With -l: show the rules of another user (root or allowed users).
-h, --host=HOST
With -l: show rules for another host.

Password and time stamp

-v, --validate
Refresh the time stamp (asks the password) without running a command.
-k, --reset-timestamp
Forget the password now (alone) or for this command.
-K, --remove-timestamp
Remove all time stamps of the user.
-n, --non-interactive
Never ask: fail if a password is needed (for scripts).
-S, --stdin
Read the password from standard input.
-A, --askpass
Use a helper program to ask the password (SUDO_ASKPASS).
-B, --bell
Ring the bell at the password prompt.
-p, --prompt=TEXT
Your own password prompt (%u = user, %h = host).
-N, --no-update
Do not update the time stamp.

Other

-V, --version
Show the version (as root also the settings).
--help
Show help.

أمثلة 12

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1Run one admin command

    sudo dnf install -y httpd
[sudo] password for student:

    Your own password. For the next minutes sudo does not ask again.

  2. 2Get a root shell for many tasks

    sudo -i
whoami
root

    exit when you are done.

  3. 3See what you may run

    sudo -l
User student may run the following commands on server1:
    (ALL) ALL

    (ALL) ALL = full rights (wheel).

  4. 4Check the rules of another user

    sudo -l -U web1

    Test a new rule without logging in as that user.

  5. 5Run a command as another user

    sudo -u postgres psql -c 'select version();'

    Many service tasks must run as the service account.

  6. 6Edit a system file safely

    sudoedit /etc/ssh/sshd_config

    Your editor runs as you; only the save is done as root.

  7. 7Write to a root file from a pipe

    echo "192.168.122.20 server2" | sudo tee -a /etc/hosts

    sudo echo ... >> file fails: the redirect is done by your own shell.

  8. 8Use sudo in a script without hanging

    sudo -n systemctl restart httpd || echo "no rights or a password is needed"

    -n never waits for a password (good for cron and CI).

  9. 9Forget the password at once

    sudo -k

    Use it before you leave your desk.

  10. 10Audit who used sudo (security)

    journalctl _COMM=sudo --since today

    Shows user, folder and command of every sudo call.

  11. 11Find users with full rights

    getent group wheel
wheel:x:10:student,devops1

    Review this list often: everybody here is root.

  12. 12Run a command with a time limit

    sudo -T 5m /usr/local/bin/cleanup.sh

    Only works if the rule allows it (Defaults user_command_timeouts).

انتبه

  • sudo cmd > /root/file fails: use | sudo tee file.
  • A rule that allows an editor, less, find or a shell escape gives full root. Allow exact commands only.
  • With NOPASSWD: a stolen session gives root at once.

الملفات

/etc/sudoers
The main rules (edit only with visudo).
/etc/sudoers.d/
Extra rule files (one per team or app).
/var/log/secure
Log of sudo use.

نصائح للحفظ

  • Give rights to a group (%webadmins), not to single users.
  • Use full paths in rules and visudo -c after every change.

رموز الخروج

0 :: The command ran fine (or sudo -l/-v worked). 1 :: sudo error (not allowed, wrong password, bad config). Otherwise the exit code of the command.

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man 8 sudo

افتح صفحة man (linux.die.net)www.sudo.ws