source: postlfs/security/sudo.xml@ bb11ee6

10.0 10.1 11.0 7.10 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since bb11ee6 was bb11ee6, checked in by Fernando de Oliveira <fernando@…>, 8 years ago

Reintroduce some modifications I did before and after, removed, by mistake. Change to upper case an OJDK switch vakue.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@12612 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 9.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY sudo-download-http "http://www.sudo.ws/sudo/dist/sudo-&sudo-version;.tar.gz">
8 <!ENTITY sudo-download-ftp "ftp://ftp.sudo.ws/pub/sudo/sudo-&sudo-version;.tar.gz">
9 <!ENTITY sudo-md5sum "a46f6de8645e6c5b6668d30657439d1c">
10 <!ENTITY sudo-size "2.1 MB">
11 <!ENTITY sudo-buildsize "24 MB (additional 1 MB for tests)">
12 <!ENTITY sudo-time "0.4 SBU">
13]>
14
15<sect1 id="sudo" xreflabel="Sudo-&sudo-version;">
16 <?dbhtml filename="sudo.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Sudo-&sudo-version;</title>
24
25 <indexterm zone="sudo">
26 <primary sortas="a-Sudo">Sudo</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Sudo</title>
31
32 <para>
33 The <application>Sudo</application> package allows a system administrator
34 to give certain users (or groups of users) the ability to run
35 some (or all) commands as
36 <systemitem class="username">root</systemitem> or another user while
37 logging the commands and arguments.
38 </para>
39
40 &lfs74_checked;
41
42 <bridgehead renderas="sect3">Package Information</bridgehead>
43 <itemizedlist spacing="compact">
44 <listitem>
45 <para>
46 Download (HTTP): <ulink url="&sudo-download-http;"/>
47 </para>
48 </listitem>
49 <listitem>
50 <para>
51 Download (FTP): <ulink url="&sudo-download-ftp;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download MD5 sum: &sudo-md5sum;
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download size: &sudo-size;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Estimated disk space required: &sudo-buildsize;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated build time: &sudo-time;
72 </para>
73 </listitem>
74 </itemizedlist>
75
76 <bridgehead renderas="sect3">Sudo Dependencies</bridgehead>
77
78 <bridgehead renderas="sect4">Optional</bridgehead>
79 <para role="optional">
80 <ulink url="http://www.openafs.org/">AFS</ulink>,
81 <ulink url="http://www.fwtk.org/">FWTK</ulink>,
82 <xref linkend="linux-pam"/>,
83 <xref linkend="mitkrb"/>,
84 an <xref linkend="server-mail"/> (that provides a
85 <command>sendmail</command> command),
86 <xref linkend="openldap"/>,
87 <ulink url="http://sourceforge.net/projects/opie/files/">Opie</ulink> and
88 <ulink url="http://www.rsa.com/node.aspx?id=1156">SecurID</ulink>
89 </para>
90
91 <para condition="html" role="usernotes">User Notes:
92 <ulink url="&blfs-wiki;/sudo"/>
93 </para>
94 </sect2>
95
96 <sect2 role="installation">
97 <title>Installation of Sudo</title>
98
99 <para>
100 Install <application>Sudo</application> by running the following commands:
101 </para>
102
103<screen><userinput>./configure --prefix=/usr \
104 --libexecdir=/usr/lib \
105 --docdir=/usr/share/doc/sudo-&sudo-version; \
106 --with-timedir=/var/lib/sudo \
107 --with-all-insults \
108 --with-env-editor \
109 --with-passprompt="[BLFS sudo] password for %p"&amp;&amp;
110make</userinput></screen>
111
112 <para>
113 To test the results, issue: <command>env LC_ALL=C make check</command>.
114 </para>
115
116 <para>
117 Now, as the <systemitem class="username">root</systemitem> user:
118 </para>
119
120<screen role="root"><userinput>make install</userinput></screen>
121
122 </sect2>
123
124 <sect2 role="commands">
125 <title>Command Explanations</title>
126
127 <para>
128 <option>--with-timedir=/var/lib/sudo</option>: This switch places
129 the variable time stamp files in a FHS compatible location.
130 </para>
131
132 <para>
133 <option>--with-all-insults</option>: This switch includes all the
134 <application>sudo</application> insult sets.
135 </para>
136
137 <para>
138 <option>--with-env-editor</option>: This switch enables use of the
139 environment variable EDITOR for <command>visudo</command>.
140 </para>
141
142 <note>
143 <para>
144 There are many options to <application>sudo</application>'s
145 <command>configure</command> command. Check the
146 <command>configure --help</command> output for a complete list.
147 </para>
148 </note>
149
150 </sect2>
151
152 <sect2 role="configuration">
153 <title>Configuring Sudo</title>
154
155 <sect3 id="sudo-config">
156 <title>Config File</title>
157
158 <para>
159 <filename>/etc/sudoers</filename>
160 </para>
161
162 <indexterm zone="sudo sudo-config">
163 <primary sortas="e-etc-sudoers">/etc/sudoers</primary>
164 </indexterm>
165
166 </sect3>
167
168 <sect3>
169 <title>Configuration Information</title>
170
171 <para>
172 The <filename>sudoers</filename> file can be quite complicated. It
173 is composed of two types of entries: aliases (basically variables) and
174 user specifications (which specify who may run what). The installation
175 installs a default configuration that has no privileges installed for any
176 user.
177 </para>
178
179 <para>
180 One example usage is to allow the system administrator to execute
181 any program without typing a password each time root privileges are
182 needed. This can be configured as:
183 </para>
184
185<screen># User alias specification
186User_Alias ADMIN = YourLoginId
187
188# Allow people in group ADMIN to run all commands without a password
189ADMIN ALL = NOPASSWD: ALL</screen>
190
191 <para>
192 For details, see <command>man sudoers</command>.
193 </para>
194
195 <note>
196 <para>
197 The <application>Sudo</application> developers highly recommend
198 using the <command>visudo</command> program to edit the
199 <filename>sudoers</filename> file. This will provide basic sanity
200 checking like syntax parsing and file permission to avoid some possible
201 mistakes that could lead to a vulnerable configuration.
202 </para>
203 </note>
204
205 <para>
206 If you've built <application>Sudo</application> with
207 <application>PAM</application> support, issue the following
208 command as the <systemitem class="username">root</systemitem> user
209 to create the <application>PAM</application> configuration file:
210 </para>
211
212<screen role="root"><userinput>cat &gt; /etc/pam.d/sudo &lt;&lt; "EOF"
213<literal># Begin /etc/pam.d/sudo
214
215# include the default auth settings
216auth include system-auth
217
218# include the default account settings
219account include system-account
220
221# Set default environment variables for the service user
222session required pam_env.so
223
224# include system session defaults
225session include system-session
226
227# End /etc/pam.d/sudo</literal>
228EOF
229chmod 644 /etc/pam.d/sudo</userinput></screen>
230
231 </sect3>
232
233 </sect2>
234
235 <sect2 role="content">
236 <title>Contents</title>
237
238 <segmentedlist>
239 <segtitle>Installed Programs</segtitle>
240 <segtitle>Installed Libraries</segtitle>
241 <segtitle>Installed Directories</segtitle>
242
243 <seglistitem>
244 <seg>
245 sudo, sudoedit (symlink), sudoreplay, and visudo
246 </seg>
247 <seg>
248 group_file.so, sudoers.so, sudo_noexec.so, and system_group.so
249 </seg>
250 <seg>
251 /etc/sudoers.d,
252 /usr/lib/sudo,
253 /usr/share/doc/sudo-&sudo-version;, and
254 /var/lib/sudo
255 </seg>
256 </seglistitem>
257 </segmentedlist>
258
259 <variablelist>
260 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
261 <?dbfo list-presentation="list"?>
262 <?dbhtml list-presentation="table"?>
263
264 <varlistentry id="sudo_prog">
265 <term><command>sudo</command></term>
266 <listitem>
267 <para>
268 executes a command as another user as permitted by
269 the <filename>/etc/sudoers</filename> configuration file.
270 </para>
271 <indexterm zone="sudo sudo">
272 <primary sortas="b-sudo">sudo</primary>
273 </indexterm>
274 </listitem>
275 </varlistentry>
276
277 <varlistentry id="sudoedit">
278 <term><command>sudoedit</command></term>
279 <listitem>
280 <para>
281 is a symlink to <command>sudo</command> that implies the
282 <option>-e</option> option to invoke an editor as another user.
283 </para>
284 <indexterm zone="sudo sudoedit">
285 <primary sortas="b-sudoedit">sudoedit</primary>
286 </indexterm>
287 </listitem>
288 </varlistentry>
289
290 <varlistentry id="visudo">
291 <term><command>visudo</command></term>
292 <listitem>
293 <para>
294 allows for safer editing of the <filename>sudoers</filename>
295 file.
296 </para>
297 <indexterm zone="sudo visudo">
298 <primary sortas="b-visudo">visudo</primary>
299 </indexterm>
300 </listitem>
301 </varlistentry>
302
303 <varlistentry id="sudoreplay">
304 <term><command>sudoreplay</command></term>
305 <listitem>
306 <para>
307 is used to play back or list the output
308 logs created by <command>sudo</command>.
309 </para>
310 <indexterm zone="sudo sudoreplay">
311 <primary sortas="b-sudoreplay">sudoreplay</primary>
312 </indexterm>
313 </listitem>
314 </varlistentry>
315
316 </variablelist>
317
318 </sect2>
319
320</sect1>
Note: See TracBrowser for help on using the repository browser.