source: postlfs/security/sudo.xml@ 087af8c

10.0 10.1 11.0 7.10 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 087af8c was 087af8c, checked in by Fernando de Oliveira <fernando@…>, 8 years ago

Updates to midori_0.5.7, Sudo-1.8.9p4, lynx 2.8.8pre.3, Qpdf-5.1.1.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@12591 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 9.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY sudo-download-http "http://www.sudo.ws/sudo/dist/sudo-&sudo-version;.tar.gz">
8 <!ENTITY sudo-download-ftp "ftp://ftp.sudo.ws/pub/sudo/sudo-&sudo-version;.tar.gz">
9 <!ENTITY sudo-md5sum "a46f6de8645e6c5b6668d30657439d1c">
10 <!ENTITY sudo-size "2.1 MB">
11 <!ENTITY sudo-buildsize "24 MB (additional 1 MB for tests)">
12 <!ENTITY sudo-time "0.4 SBU">
13]>
14
15<sect1 id="sudo" xreflabel="Sudo-&sudo-version;">
16 <?dbhtml filename="sudo.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Sudo-&sudo-version;</title>
24
25 <indexterm zone="sudo">
26 <primary sortas="a-Sudo">Sudo</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Sudo</title>
31
32 <para>
33 The <application>Sudo</application> package allows a system administrator
34 to give certain users (or groups of users) the ability to run
35 some (or all) commands as
36 <systemitem class="username">root</systemitem> or another user while
37 logging the commands and arguments.
38 </para>
39
40 &lfs74_checked;
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>
46 Download (HTTP): <ulink url="&sudo-download-http;"/>
47 </para>
48 </listitem>
49 <listitem>
50 <para>
51 Download (FTP): <ulink url="&sudo-download-ftp;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download MD5 sum: &sudo-md5sum;
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download size: &sudo-size;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Estimated disk space required: &sudo-buildsize;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated build time: &sudo-time;
72 </para>
73 </listitem>
74 </itemizedlist>
75
76 <bridgehead renderas="sect3">Sudo Dependencies</bridgehead>
77
78 <bridgehead renderas="sect4">Optional</bridgehead>
79 <para role="optional">
80 <ulink url="http://www.openafs.org/">AFS</ulink>,
81 <ulink url="http://www.fwtk.org/">FWTK</ulink>,
82 <xref linkend="linux-pam"/>,
83 <xref linkend="mitkrb"/>,
84 an <xref linkend="server-mail"/> (that provides a
85 <command>sendmail</command> command),
86 <xref linkend="openldap"/>,
87 <ulink url="http://sourceforge.net/projects/opie/files/">Opie</ulink> and
88 <ulink url="http://www.rsa.com/node.aspx?id=1156">SecurID</ulink>
89 </para>
90
91 <para condition="html" role="usernotes">User Notes:
92 <ulink url="&blfs-wiki;/sudo"/>
93 </para>
94 </sect2>
95
96 <sect2 role="installation">
97 <title>Installation of Sudo</title>
98
99 <para>
100 Install <application>Sudo</application> by running the following commands:
101 </para>
102
103<screen><userinput>./configure --prefix=/usr \
104 --libexecdir=/usr/lib \
105 --docdir=/usr/share/doc/sudo-&sudo-version; \
106 --with-timedir=/var/lib/sudo \
107 --with-all-insults \
108 --with-env-editor &amp;&amp;
109make</userinput></screen>
110
111 <para>
112 To test the results, issue: <command>env LC_ALL=C make check</command>.
113 </para>
114
115 <para>
116 Now, as the <systemitem class="username">root</systemitem> user:
117 </para>
118
119<screen role="root"><userinput>make install</userinput></screen>
120
121 </sect2>
122
123 <sect2 role="commands">
124 <title>Command Explanations</title>
125
126 <para>
127 <option>--with-timedir=/var/lib/sudo</option>: This switch places
128 the variable time stamp files in a FHS compatible location.
129 </para>
130
131 <para>
132 <option>--with-all-insults</option>: This switch includes all the
133 <application>sudo</application> insult sets.
134 </para>
135
136 <para>
137 <option>--with-env-editor</option>: This switch enables use of the
138 environment variable EDITOR for <command>visudo</command>.
139 </para>
140
141 <para>
142 <option>--with-passprompt="[sudo] password for %p"</option>: Use this
143 switch to define the prompt (change it to fit your preference).
144 </para>
145
146 <note>
147 <para>
148 There are many options to <application>sudo</application>'s
149 <command>configure</command> command. Check the
150 <command>configure --help</command> output for a complete list.
151 </para>
152 </note>
153
154 </sect2>
155
156 <sect2 role="configuration">
157 <title>Configuring Sudo</title>
158
159 <sect3 id="sudo-config">
160 <title>Config File</title>
161
162 <para>
163 <filename>/etc/sudoers</filename>
164 </para>
165
166 <indexterm zone="sudo sudo-config">
167 <primary sortas="e-etc-sudoers">/etc/sudoers</primary>
168 </indexterm>
169
170 </sect3>
171
172 <sect3>
173 <title>Configuration Information</title>
174
175 <para>
176 The <filename>sudoers</filename> file can be quite complicated. It
177 is composed of two types of entries: aliases (basically variables) and
178 user specifications (which specify who may run what). The installation
179 installs a default configuration that has no privileges installed for any
180 user.
181 </para>
182
183 <para>
184 One example usage is to allow the system administrator to execute
185 any program without typing a password each time root privileges are
186 needed. This can be configured as:
187 </para>
188
189<screen># User alias specification
190User_Alias ADMIN = YourLoginId
191
192# Allow people in group ADMIN to run all commands without a password
193ADMIN ALL = NOPASSWD: ALL</screen>
194
195 <para>
196 For details, see <command>man sudoers</command>.
197 </para>
198
199 <note>
200 <para>
201 The <application>Sudo</application> developers highly recommend
202 using the <command>visudo</command> program to edit the
203 <filename>sudoers</filename> file. This will provide basic sanity
204 checking like syntax parsing and file permission to avoid some possible
205 mistakes that could lead to a vulnerable configuration.
206 </para>
207 </note>
208
209 <para>
210 If you've built <application>Sudo</application> with
211 <application>PAM</application> support, issue the following
212 command as the <systemitem class="username">root</systemitem> user
213 to create the <application>PAM</application> configuration file:
214 </para>
215
216<screen role="root"><userinput>cat &gt; /etc/pam.d/sudo &lt;&lt; "EOF"
217<literal># Begin /etc/pam.d/sudo
218
219# include the default auth settings
220auth include system-auth
221
222# include the default account settings
223account include system-account
224
225# Set default environment variables for the service user
226session required pam_env.so
227
228# include system session defaults
229session include system-session
230
231# End /etc/pam.d/sudo</literal>
232EOF
233chmod 644 /etc/pam.d/sudo</userinput></screen>
234
235 </sect3>
236
237 </sect2>
238
239 <sect2 role="content">
240 <title>Contents</title>
241
242 <segmentedlist>
243 <segtitle>Installed Programs</segtitle>
244 <segtitle>Installed Libraries</segtitle>
245 <segtitle>Installed Directories</segtitle>
246
247 <seglistitem>
248 <seg>
249 sudo, sudoedit (symlink), sudoreplay, and visudo
250 </seg>
251 <seg>
252 group_file.so, sudoers.so, sudo_noexec.so, and system_group.so
253 </seg>
254 <seg>
255 /etc/sudoers.d,
256 /usr/lib/sudo,
257 /usr/share/doc/sudo-&sudo-version;, and
258 /var/lib/sudo
259 </seg>
260 </seglistitem>
261 </segmentedlist>
262
263 <variablelist>
264 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
265 <?dbfo list-presentation="list"?>
266 <?dbhtml list-presentation="table"?>
267
268 <varlistentry id="sudo_prog">
269 <term><command>sudo</command></term>
270 <listitem>
271 <para>
272 executes a command as another user as permitted by
273 the <filename>/etc/sudoers</filename> configuration file.
274 </para>
275 <indexterm zone="sudo sudo">
276 <primary sortas="b-sudo">sudo</primary>
277 </indexterm>
278 </listitem>
279 </varlistentry>
280
281 <varlistentry id="sudoedit">
282 <term><command>sudoedit</command></term>
283 <listitem>
284 <para>
285 is a symlink to <command>sudo</command> that implies the
286 <option>-e</option> option to invoke an editor as another user.
287 </para>
288 <indexterm zone="sudo sudoedit">
289 <primary sortas="b-sudoedit">sudoedit</primary>
290 </indexterm>
291 </listitem>
292 </varlistentry>
293
294 <varlistentry id="visudo">
295 <term><command>visudo</command></term>
296 <listitem>
297 <para>
298 allows for safer editing of the <filename>sudoers</filename>
299 file.
300 </para>
301 <indexterm zone="sudo visudo">
302 <primary sortas="b-visudo">visudo</primary>
303 </indexterm>
304 </listitem>
305 </varlistentry>
306
307 <varlistentry id="sudoreplay">
308 <term><command>sudoreplay</command></term>
309 <listitem>
310 <para>
311 is used to play back or list the output
312 logs created by <command>sudo</command>.
313 </para>
314 <indexterm zone="sudo sudoreplay">
315 <primary sortas="b-sudoreplay">sudoreplay</primary>
316 </indexterm>
317 </listitem>
318 </varlistentry>
319
320 </variablelist>
321
322 </sect2>
323
324</sect1>
Note: See TracBrowser for help on using the repository browser.