sudo(8) の使い方

sudo(8)を実行できるユーザや、コマンドを制御する方法を示す。

デフォルト状態

$ sudo yum check-update
[sudo] password for owner:
owner is not in the sudoers file.  This incident will be reported.
$ sudo yum update
[sudo] password for owner:
owner is not in the sudoers file.  This incident will be reported.

定義追加(最終行に下記1行を追加)

# visudo
…
owner ALL=(ALL) /usr/bin/yum

再度実行

$ sudo yum check-update
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
$ sudo yum update
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Setting up Update Process
No Packages marked for Update
You have new mail in /var/spool/mail/owner

check-updateだけを許す設定に変えてみる

# visudo
…
owner ALL=(ALL) /usr/bin/yum check-update

再度実行

$ sudo yum check-update
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
$ sudo yum update
Sorry, user owner is not allowed to execute '/usr/bin/yum update' as root on localhost.localdomain.

sudoの一部エラーは、セキュリティアタックの可能性としてroot宛メールで通知される

localhost.localdomain :  2月 24 10:08:56 : owner : user NOT in sudoers ; TTY=pts/3 ; PWD=/home/owner ; USER=root ; COMMAND=/usr/bin/yum update

• 全てのエラーが見たければ、/var/log/secureを見ると良い