source: postlfs/security/sudo.xml@ 63a26be

10.0 10.1 11.0 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind ken/refactor-virt lazarus perl-modules qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 63a26be was 63a26be, checked in by Douglas R. Reno <renodr@…>, 5 years ago

Tags!

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@18306 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 10.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY sudo-download-http "http://www.sudo.ws/dist/sudo-&sudo-version;.tar.gz">
8 <!ENTITY sudo-download-ftp "ftp://ftp.sudo.ws/pub/sudo/sudo-&sudo-version;.tar.gz">
9 <!ENTITY sudo-md5sum "31a6090ed1d0946fa22cba19e86aafef">
10 <!ENTITY sudo-size "2.7 MB">
11 <!ENTITY sudo-buildsize "28 MB (with tests)">
12 <!ENTITY sudo-time "0.3 SBU (with tests)">
13]>
14
15<sect1 id="sudo" xreflabel="Sudo-&sudo-version;">
16 <?dbhtml filename="sudo.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Sudo-&sudo-version;</title>
24
25 <indexterm zone="sudo">
26 <primary sortas="a-Sudo">Sudo</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Sudo</title>
31
32 <para>
33 The <application>Sudo</application> package allows a system administrator
34 to give certain users (or groups of users) the ability to run
35 some (or all) commands as
36 <systemitem class="username">root</systemitem> or another user while
37 logging the commands and arguments.
38 </para>
39
40 &lfs80_checked;
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>
46 Download (HTTP): <ulink url="&sudo-download-http;"/>
47 </para>
48 </listitem>
49 <listitem>
50 <para>
51 Download (FTP): <ulink url="&sudo-download-ftp;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download MD5 sum: &sudo-md5sum;
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download size: &sudo-size;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Estimated disk space required: &sudo-buildsize;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated build time: &sudo-time;
72 </para>
73 </listitem>
74 </itemizedlist>
75
76 <bridgehead renderas="sect3">Sudo Dependencies</bridgehead>
77
78 <bridgehead renderas="sect4">Optional</bridgehead>
79 <para role="optional">
80 <xref linkend="linux-pam"/>,
81 <xref linkend="mitkrb"/>,
82 <xref linkend="openldap"/>,
83 <xref linkend="server-mail"/> (that provides a
84 <command>sendmail</command> command),
85 <ulink url="http://www.openafs.org/">AFS</ulink>,
86 <ulink url="http://www.fwtk.org/">FWTK</ulink>, and
87 <ulink url="http://sourceforge.net/projects/opie/files/">Opie</ulink>
88<!-- <ulink url="http://www.rsa.com/node.aspx?id=1156">SecurID</ulink>-->
89 </para>
90
91 <para condition="html" role="usernotes">User Notes:
92 <ulink url="&blfs-wiki;/sudo"/>
93 </para>
94 </sect2>
95
96 <sect2 role="installation">
97 <title>Installation of Sudo</title>
98
99 <para>
100 Install <application>Sudo</application> by running the following commands:
101 </para>
102
103<!-- Developer: apparently it is disabled by default, although in configure it
104is written otherwise -disable-static \-->
105<screen><userinput>./configure --prefix=/usr \
106 --libexecdir=/usr/lib \
107 --with-secure-path \
108 --with-all-insults \
109 --with-env-editor \
110 --docdir=/usr/share/doc/sudo-&sudo-version; \
111 --with-passprompt="[sudo] password for %p" &amp;&amp;
112make</userinput></screen>
113
114 <para>
115 To test the results, issue: <command>env LC_ALL=C make check 2&gt;&amp;1
116 | tee ../make-check.log</command>. Check the results with <command>grep
117 failed ../make-check.log</command>.
118 </para>
119
120 <para>
121 Now, as the <systemitem class="username">root</systemitem> user:
122 </para>
123
124<screen role="root"><userinput>make install &amp;&amp;
125ln -sfv libsudo_util.so.0.0.0 /usr/lib/sudo/libsudo_util.so.0</userinput></screen>
126
127 </sect2>
128
129 <sect2 role="commands">
130 <title>Command Explanations</title>
131
132 <para>
133 <parameter>--libexecdir=/usr/lib</parameter>: This switch controls where
134 private programs are installed. Everything in that directory is a library, so
135 they belong under <filename class="directory">/usr/lib</filename> instead of
136 <filename class="directory">/usr/libexec</filename>.
137 </para>
138
139 <para>
140 <parameter>--with-secure-path</parameter>: This switch transparently adds
141 <filename class="directory">/sbin</filename> and <filename
142 class="directory">/usr/sbin</filename> directories to the
143 <envar>PATH</envar> environment variable.
144 </para>
145
146 <para>
147 <parameter>--with-all-insults</parameter>: This switch includes all the
148 <application>sudo</application> insult sets.
149 </para>
150
151 <para>
152 <parameter>--with-env-editor</parameter>: This switch enables use of the
153 environment variable EDITOR for <command>visudo</command>.
154 </para>
155
156 <para>
157 <parameter>--with-passprompt</parameter>: This switch sets the prompt.
158 </para>
159
160 <para>
161 <option>--without-pam</option>: This switch avoids building
162 <application>Linux-PAM</application> support when
163 <application>Linux-PAM</application> is installed on the system.
164 </para>
165<!-- See the developper note above before the configure command
166 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
167 href="../../xincludes/static-libraries.xml"/>-->
168
169 <note>
170 <para>
171 There are many options to <application>sudo</application>'s
172 <command>configure</command> command. Check the
173 <command>configure --help</command> output for a complete list.
174 </para>
175 </note>
176
177 <para>
178 <command>ln -sfv libsudo_util...</command>: Works around a bug in the
179 installation process, which links to the previously installed
180 version (if there is one) instead of the new one.
181 </para>
182
183 </sect2>
184
185 <sect2 role="configuration">
186 <title>Configuring Sudo</title>
187
188 <sect3 id="sudo-config">
189 <title>Config File</title>
190
191 <para>
192 <filename>/etc/sudoers</filename>
193 </para>
194
195 <indexterm zone="sudo sudo-config">
196 <primary sortas="e-etc-sudoers">/etc/sudoers</primary>
197 </indexterm>
198
199 </sect3>
200
201 <sect3>
202 <title>Configuration Information</title>
203
204 <para>
205 The <filename>sudoers</filename> file can be quite complicated. It
206 is composed of two types of entries: aliases (basically variables) and
207 user specifications (which specify who may run what). The installation
208 installs a default configuration that has no privileges installed for
209 any user.
210 </para>
211
212 <para>
213 One example usage is to allow the system administrator to execute
214 any program without typing a password each time root privileges are
215 needed. This can be configured as:
216 </para>
217
218<screen># User alias specification
219User_Alias ADMIN = <replaceable>YourLoginId</replaceable>
220
221# Allow people in group ADMIN to run all commands without a password
222ADMIN ALL = NOPASSWD: ALL</screen>
223
224 <para>
225 For details, see <command>man sudoers</command>.
226 </para>
227
228 <note>
229 <para>
230 The <application>Sudo</application> developers highly recommend
231 using the <command>visudo</command> program to edit the
232 <filename>sudoers</filename> file. This will provide basic sanity
233 checking like syntax parsing and file permission to avoid some
234 possible mistakes that could lead to a vulnerable configuration.
235 </para>
236 </note>
237
238 <para>
239 If <application>PAM</application> is installed on the system,
240 <application>Sudo</application> is built with
241 <application>PAM</application> support. In that case, issue the
242 following command as the <systemitem class="username">root</systemitem>
243 user to create the <application>PAM</application> configuration file:
244 </para>
245
246<screen role="root"><userinput>cat &gt; /etc/pam.d/sudo &lt;&lt; "EOF"
247<literal># Begin /etc/pam.d/sudo
248
249# include the default auth settings
250auth include system-auth
251
252# include the default account settings
253account include system-account
254
255# Set default environment variables for the service user
256session required pam_env.so
257
258# include system session defaults
259session include system-session
260
261# End /etc/pam.d/sudo</literal>
262EOF
263chmod 644 /etc/pam.d/sudo</userinput></screen>
264
265 </sect3>
266
267 </sect2>
268
269 <sect2 role="content">
270 <title>Contents</title>
271
272 <segmentedlist>
273 <segtitle>Installed Programs</segtitle>
274 <segtitle>Installed Libraries</segtitle>
275 <segtitle>Installed Directories</segtitle>
276
277 <seglistitem>
278 <seg>
279 sudo, sudoedit (symlink), sudoreplay, and visudo
280 </seg>
281 <seg>
282 group_file.so, libsudo_util.so,
283 sudoers.so, sudo_noexec.so, and system_group.so
284 </seg>
285 <seg>
286 /etc/sudoers.d,
287 /usr/lib/sudo,
288 /usr/share/doc/sudo-&sudo-version;, and
289 /var/{lib,run}/sudo
290 </seg>
291 </seglistitem>
292 </segmentedlist>
293
294 <variablelist>
295 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
296 <?dbfo list-presentation="list"?>
297 <?dbhtml list-presentation="table"?>
298
299 <varlistentry id="sudo_prog">
300 <term><command>sudo</command></term>
301 <listitem>
302 <para>
303 executes a command as another user as permitted by
304 the <filename>/etc/sudoers</filename> configuration file.
305 </para>
306 <indexterm zone="sudo sudo">
307 <primary sortas="b-sudo">sudo</primary>
308 </indexterm>
309 </listitem>
310 </varlistentry>
311
312 <varlistentry id="sudoedit">
313 <term><command>sudoedit</command></term>
314 <listitem>
315 <para>
316 is a symlink to <command>sudo</command> that implies the
317 <option>-e</option> option to invoke an editor as another user.
318 </para>
319 <indexterm zone="sudo sudoedit">
320 <primary sortas="b-sudoedit">sudoedit</primary>
321 </indexterm>
322 </listitem>
323 </varlistentry>
324
325 <varlistentry id="sudoreplay">
326 <term><command>sudoreplay</command></term>
327 <listitem>
328 <para>
329 is used to play back or list the output
330 logs created by <command>sudo</command>.
331 </para>
332 <indexterm zone="sudo sudoreplay">
333 <primary sortas="b-sudoreplay">sudoreplay</primary>
334 </indexterm>
335 </listitem>
336 </varlistentry>
337
338 <varlistentry id="visudo">
339 <term><command>visudo</command></term>
340 <listitem>
341 <para>
342 allows for safer editing of the <filename>sudoers</filename>
343 file.
344 </para>
345 <indexterm zone="sudo visudo">
346 <primary sortas="b-visudo">visudo</primary>
347 </indexterm>
348 </listitem>
349 </varlistentry>
350
351 </variablelist>
352
353 </sect2>
354
355</sect1>
Note: See TracBrowser for help on using the repository browser.