Sudo (Українська)

This article is being considered for redirection to
sudo
.
Notes:
Translation stalled. (Discuss in
Talk:Sudo (Українська)
)
Цю стаття чи розділ ще не перекладено. Дивіться також
Команда перекладу ArchWiki українською
.
Причина:
Partial translation was started 2021-12-12. (Обговорення в
Talk:Sudo (Українська)#
)
Повʼязані статті
Users and groups
su
doas
Sudo
дозволяє системному адміністратору передавати різним користувачам чи групам користувачів повноваження запускати команди від імені користувача „root“ чи будь-якого іншого користувача. Окрім цього, команда веде часопис використаних команд та їх аргументів.
Інший спосіб запускати команди як root —
su
. От тільки, якщо
su
відкриває root консоль в якій можна вводити багато команд, то sudo дає право виконати лише одну команду. Завдяки цьому, зменшується ймовірність виконати команду з помилкою й поламати свою систему.
Із Sudo ще й можна запускати команди від імені інших користувачів. А використані команди та невдалі спроби отримати доступ записуються до журналу, для перевірки безпеки.
Встановлення
Встановіть
пакунок
sudo
.
Використання
Перед використанням,
sudo
потрібно налагодити. Прочитайте
#Налагодження
.
Щоб скористатися
sudo
, просто додайте
sudo
поперед команди та її аргументів:
$ sudo
команда
Наприклад, для pacman:
$ sudo pacman -Syu
Прочитайте
sudo(8)
щоб дізнатися більше.
Налагодження
This article or section needs expansion.
Reason:
Create an intro discussing
Defaults
, perhaps with a table that lists common settings (Discuss in
Talk:Sudo (Українська)
)
Defaults skeleton
sudoers(5) § SUDOERS OPTIONS
lists all the options that can be used with the
Defaults
command in the
/etc/sudoers
file.
See
[1]
for a list of options (parsed from the version 1.8.7 source code) in a format optimized for
sudoers
.
See
sudoers(5)
for more information, such as configuring the password timeout.
Переглянути наявні налаштування
Запустіть
sudo -ll
щоб вивести налаштування, прийняті на даний момент. Щоб дізнатися налаштування для певного користувача, запустіть
sudo -lU
ім'я_користувача
.
Використання visudo
Налаштування для sudo знаходяться у файлі
/etc/sudoers
. Його можна редагувати
тільки
через команду
visudo(8)
. Вона блокує оригінальний файл, створює тимчасову копію і перевіряє його на наявність помилок, переди тим як скопіювати його назад до
/etc/sudoers
.
Попередження
Ви зобов'язані написати
sudoers
без помилок! Будь-яка помилка зробить sudo непридатним для використання.
Завжди
використовуйте
visudo
щоб запобігти утворенню помилок.
visudo(8)
warns that configuring
visudo
to honor the user environment variables for their editor of choice may be a security hole, since it allows the user with
visudo
privileges to run arbitrary commands as root without logging simply by setting that variable to something else.
visudo
використовує
vi
для редагування тексту. The
sudo
package is compiled with
--with-env-editor
and honors the use of the
SUDO_EDITOR
,
VISUAL
and
EDITOR
variables.
EDITOR
is not used when
VISUAL
is set.
To establish
nano
as the
visudo
editor for the duration of the current shell session, export
EDITOR=nano
; to use a different editor just once simply set the variable before calling
visudo
:
# EDITOR=nano visudo
Alternatively you may edit a copy of the
/etc/sudoers
file and check it using
visudo -c
/copy/of/sudoers
. This might come in handy in case you want to circumvent locking the file with
visudo
.
To change the editor permanently, see
Environment variables#Per user
. To change the editor of choice permanently system-wide only for
visudo
, add the following to
/etc/sudoers
(assuming
nano
is your preferred editor):
# Reset environment by default
Defaults      env_reset
# Set default EDITOR to nano, and do not allow visudo to use EDITOR/VISUAL.
Defaults      editor=/usr/bin/nano, !env_editor
Example entries
To allow a user to gain full root privileges when they precede a command with
sudo
, add the following line:
USER_NAME   ALL=(ALL) ALL
To allow a user to run all commands as any user but only on the machine with hostname
HOST_NAME
:
USER_NAME   HOST_NAME=(ALL) ALL
To allow members of group
wheel
sudo access:
%wheel      ALL=(ALL) ALL
Tip
When creating new administrators, it is often desirable to enable sudo access for the
wheel
group and
add the user to it
, since by default
Polkit
treats the members of the
wheel
group as administrators. If the user is not a member of
wheel
, software using Polkit may ask to authenticate using the root password instead of the user password.
To disable asking for a password for user
USER_NAME
:
Warning
This will allow any process running with your user name to use sudo without asking for permission.
Defaults:USER_NAME      !authenticate
Enable explicitly defined commands only for user
USER_NAME
on host
HOST_NAME
:
USER_NAME HOST_NAME=/usr/bin/halt,/usr/bin/poweroff,/usr/bin/reboot,/usr/bin/pacman -Syu
Note
The most customized option should go at the end of the file, as the later lines overrides the previous ones. In particular such a line should be after the
%wheel
line if your user is in this group.
Enable explicitly defined commands only for user
USER_NAME
on host
HOST_NAME
without password:
USER_NAME HOST_NAME= NOPASSWD: /usr/bin/halt,/usr/bin/poweroff,/usr/bin/reboot,/usr/bin/pacman -Syu
A detailed
sudoers
example is available at
/usr/share/doc/sudo/examples/sudoers
. Otherwise, see the
sudoers(5)
for detailed information.
Sudoers default file permissions
The owner and group for the
sudoers
file must both be 0. The file permissions must be set to 0440. These permissions are set by default, but if you accidentally change them, they should be changed back immediately or sudo will fail.
# chown -c root:root /etc/sudoers
# chmod -c 0440 /etc/sudoers
Корисні поради
Вимкнути термін очікування при введенні паролю
Найдратівливіша ситуація: тривалий процес, що працює десь на тлі, із нормальними дозволами, та піднімається лише за потреби. В такому разі, він потребує паролю для sudo. Якщо його не помітити, то він застаріває й процес, в найкращому випадку, вилітає. Щоби справитись із цим, радимо вимкнути пароль для sudo або збільшити його термін очікування. Можна взагалі вимкнути термін очікування паролю, та як воно взагалі не підвищує рівень безпеки, для цього встановіть його рівним нулю:
Defaults passwd_timeout=0
Add terminal bell to the password prompt
To draw attention to a sudo prompt in a background terminal, users can simply make it echo a
bell character
:
Defaults passprompt="^G[sudo] password for %p: "
Note the
^G
is a literal bell character. E.g. in
vim
, insert using the sequence
Ctrl+v
Ctrl+g
, or in
nano
,
Alt+v
Ctrl+g
.
Passing aliases
If you use a lot of aliases, you might have noticed that they do not carry over to the root account when using sudo. However, there is an easy way to make them work. Simply add the following to your
~/.bashrc
or
/etc/bash.bashrc
:
alias sudo='sudo '
Disable per-terminal sudo
Warning
This will let any process use your sudo session.
If you are annoyed by sudo's defaults that require you to enter your password every time you open a new terminal, set
timestamp_type
to
global
:
Defaults timestamp_type=global
Reduce the number of times you have to type a password
If you are annoyed that you have to re-enter your password every 5 minutes (default), you can change this by setting a longer value for
timestamp_timeout
(in minutes):
Defaults timestamp_timeout=10
If you are using a lot of sudo commands on a row, it is more logical to refresh the timeout every time you use sudo than
to increase
timestamp_timeout
. Refreshing the timeout can be done with
sudo -v
(whereas
sudo -K
revokes immediately).
You might want to automate this by adding the following to your
.bashrc
:
alias sudo='sudo -v; sudo '
It is also possible to use a bash function; for more details see
stackexchange
.
Environment variables
If you have a lot of environment variables, or you export your proxy settings via
export http_proxy="..."
, when using sudo these variables do not get passed to the root account unless you run sudo with the
-E
option.
$ sudo -E pacman -Syu
The recommended way of preserving environment variables is to append them to
env_keep
:
/etc/sudoers
Defaults env_keep += "ftp_proxy http_proxy https_proxy no_proxy"
Root password
Users can configure sudo to ask for the root password instead of the user password by adding
targetpw
(target user, defaults to root) or
rootpw
to the Defaults line in
/etc/sudoers
:
Defaults targetpw
To prevent exposing your root password to users, you can restrict this to a specific group:
Defaults:%wheel targetpw
%wheel ALL=(ALL) ALL
Disable root login
Users may wish to disable the root login. Without root, attackers must first guess a user name configured as a sudoer as well as the user password. See for example
OpenSSH#Deny
.
Warning
Be careful, you may lock yourself out by disabling root login. Sudo is not automatically installed and its default configuration allows neither passwordless root access nor root access with your own password. Ensure a user is properly configured as a sudoer
before
disabling the root account!
If you have changed your sudoers file to use rootpw as default, then do not disable root login with any of the following commands!
If you are already locked out, see
Password recovery
for help.
The account can be locked via
passwd
:
# passwd -l root
A similar command unlocks root.
$ sudo passwd -u root
Alternatively, edit
/etc/shadow
and replace the root's encrypted password with "!":
root:!:12345::::::
To enable root login again:
$ sudo passwd root
Tip
To get to an interactive root prompt, even after disabling the
root
account, use
sudo -i
.
kdesu
kdesu may be used under
KDE
to launch GUI applications with root privileges. It is possible that by default kdesu will try to use su even if the root account is disabled. Fortunately one can tell kdesu to use sudo instead of su. Create/edit the file
~/.config/kdesurc
:
[super-user-command]
super-user-command=sudo
or use the following command:
$ kwriteconfig5 --file kdesurc --group super-user-command --key super-user-command sudo
Harden with sudo example
Let us say you create 3 users: admin, devel, and joe. The user "admin" is used for journalctl, systemctl, mount, kill, and iptables; "devel" is used for installing packages, and editing config files; and "joe" is the user you log in with. To let "joe" reboot, shutdown, and use netctl we would do the following:
Edit
/etc/pam.d/su
and
/etc/pam.d/su-l
. Require user be in the wheel group, but do not put anyone in it.
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so use_uid
auth            required        pam_unix.so
account         required        pam_unix.so
session         required        pam_unix.so
Limit SSH login to the 'ssh' group. Only "joe" will be part of this group.
# groupadd -r ssh
# gpasswd -a joe ssh
# echo 'AllowGroups ssh' >> /etc/ssh/sshd_config
Restart
sshd.service
.
Add users to other groups.
for g in power network ;do ;gpasswd -a joe $g ;done
# for g in network power storage ;do ;gpasswd -a admin $g ;done
Set permissions on configs so devel can edit them.
# chown -R devel:root /etc/{http,openvpn,cups,zsh,vim,screenrc}
Cmnd_Alias  POWER       =   /usr/bin/shutdown -h now, /usr/bin/halt, /usr/bin/poweroff, /usr/bin/reboot
Cmnd_Alias  STORAGE     =   /usr/bin/mount -o nosuid\,nodev\,noexec, /usr/bin/umount
Cmnd_Alias  SYSTEMD     =   /usr/bin/journalctl, /usr/bin/systemctl
Cmnd_Alias  KILL        =   /usr/bin/kill, /usr/bin/killall
Cmnd_Alias  PKGMAN      =   /usr/bin/pacman
Cmnd_Alias  NETWORK     =   /usr/bin/netctl
Cmnd_Alias  FIREWALL    =   /usr/bin/iptables, /usr/bin/ip6tables
Cmnd_Alias  SHELL       =   /usr/bin/zsh, /usr/bin/bash
%power      ALL         =   (root)  NOPASSWD: POWER
%network    ALL         =   (root)  NETWORK
%storage    ALL         =   (root)  STORAGE
root        ALL         =   (ALL)   ALL
admin       ALL         =   (root)  SYSTEMD, KILL, FIREWALL
devel	    ALL         =   (root)  PKGMAN
joe	    ALL         =   (devel) SHELL, (admin) SHELL
With this setup, you will almost never need to login as the Root user.
"joe" can connect to his home WiFi.
$ sudo netctl start home
$ sudo poweroff
"joe" can not use netctl as any other user.
$ sudo -u admin -- netctl start home
When "joe" needs to use journalctl or kill run away process he can switch to that user.
$ sudo -i -u devel
$ sudo -i -u admin
But "joe" cannot switch to the root user.
$ sudo -i -u root
If "joe" want to start a gnu-screen session as admin he can do it like this:
$ sudo -i -u admin
[admin]$ chown admin:tty `echo $TTY`
[admin]$ screen
Configure sudo using drop-in files in /etc/sudoers.d
sudo
parses files contained in the directory
/etc/sudoers.d/
. This means that instead of editing
/etc/sudoers
, you can change settings in standalone files and drop them in that directory. This has two advantages:
There is no need to edit a
sudoers.pacnew
file;
If there is a problem with a new entry, you can remove the offending file instead of editing
/etc/sudoers
(but see the warning below).
The format for entries in these drop-in files is the same as for
/etc/sudoers
itself. To edit them directly, use
visudo -f /etc/sudoers.d/
somefile
. See
sudoers(5) § Including other files from within sudoers
for details.
The files in
/etc/sudoers.d/
directory are parsed in lexicographical order, file names containing
.
or
~
are skipped. To avoid sorting problems, the file names should begin with two digits, e.g.
01_foo
.
Note
The order of entries in the drop-in files is important: make sure that the statements do not override themselves.
Warning
The files in
/etc/sudoers.d/
are just as fragile as
/etc/sudoers
itself: any improperly formatted file will prevent
sudo
from working.  Hence, for the same reason it is strongly advised to use
visudo
Editing files
sudo -e
or
sudoedit
lets you edit a file as another user while still running the text editor as your user.
This is especially useful for editing files as root without elevating the privilege of your text editor, for more details read
sudo(8) § e
.
Note that you can set the editor to any program, so for example one can use
meld
to manage
pacnew
files:
$ SUDO_EDITOR=meld sudo -e /etc/
file
{,.pacnew}
Увімкнути лайки
Ви можете увімкнути лайки в sudo. Для цього додайте цей рядок до файлу
sudoers
використовуючи
visudo
:
/etc/sudoers
Defaults insults
Якщо ви введете хибний пароль, то замість строки
слід вказати пароль
sudo буде писати різні кумедні образи. Нажаль лише англійською.
Troubleshooting
SSH problem without TTY
This article or section is a candidate for merging with
#Configuration
.
Notes:
please use the second argument of the template to provide more detailed indications.
(Discuss in
Talk:Sudo (Українська)
)
SSH does not allocate a tty by default when running a remote command. Without an allocated tty, sudo cannot prevent the password from being displayed. You can use ssh's
-t
option to force it to allocate a tty.
The
Defaults
option
requiretty
only allows the user to run sudo if they have a tty.
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear text. You have to run "ssh -t hostname sudo <cmd>".
#
#Defaults    requiretty
Permissive umask
This article or section is a candidate for merging with
#Configuration
.
Notes:
please use the second argument of the template to provide more detailed indications.
(Discuss in
Talk:Sudo (Українська)
)
Sudo will union the user's
umask
value with its own umask (which defaults to 0022). This prevents sudo from creating files with more open permissions than the user's umask allows. While this is a sane default if no custom umask is in use, this can lead to situations where a utility run by sudo may create files with different permissions than if run by root directly. If errors arise from this, sudo provides a means to fix the umask, even if the desired umask is more permissive than the umask that the user has specified. Adding this (using
visudo
) will override sudo's default behavior:
Defaults umask = 0022
Defaults umask_override
This sets sudo's umask to root's default umask (0022) and overrides the default behavior, always using the indicated umask regardless of what umask the user as set.