sudo va imtiyozlarni boshqarish

Root bo'lib ishlash - serverni yo'qotishning eng qisqa yo'li. sudo uchta narsani beradi: cheklangan huquq, jurnalga yozilgan harakat va parol bilan tasdiqlangan niyat.

Nima uchun root bo'lib ishlamaslik kerak #

rm -rf $ZAXIRA /*

sudo guruhi #

Ubuntu va Debianda sudo guruhi a'zolari to'liq huquqqa ega.

for u in malika nodira; do userdel -r "$u"; done 2>/dev/null
groupdel dasturchilar 2>/dev/null
groupadd -g 1200 dasturchilar
useradd -u 1101 -m -s /bin/bash -g dasturchilar malika
useradd -u 1102 -m -s /bin/bash -g dasturchilar nodira

cat > /etc/sudoers.d/zz-sinov <<'EOF'
# Malika - to'liq huquq, lekin parol bilan
malika ALL=(ALL:ALL) ALL

# Nodira - faqat nginx ni qayta ishga tushirishi mumkin
Cmnd_Alias VEB = /usr/bin/systemctl restart nginx, \
                 /usr/bin/systemctl status nginx
nodira ALL=(root) NOPASSWD: VEB
EOF
chmod 440 /etc/sudoers.d/zz-sinov

getent group sudo

sudo:x:27:husanboy

Foydalanuvchini qo'shish - bitta buyruq:

usermod -aG sudo malika
getent group sudo | cut -d: -f4

husanboy,malika

Qoidalarni ko'rish #

sudo -l -U nodira | sed "s/$(hostname)/srv-01/g"

Matching Defaults entries for nodira on srv-01:
    env_reset, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User nodira may run the following commands on srv-01:
    (root) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx

(sed bu yerda faqat tekshiruv mashinasining nomini srv-01 ga almashtiradi - chiqishning qolgani o'zgarmagan.)

Nodira faqat ikkita aniq buyruqni ishga tushira oladi - boshqa hech nimani.

Faylni to'g'ri tahrirlash #

/etc/sudoers ni hech qachon oddiy muharrirda ochmang.

visudo -cf /etc/sudoers.d/zz-sinov

/etc/sudoers.d/zz-sinov: parsed OK

Xato sintaksis qanday ko'rinadi:

echo 'nodira ALL=(ALL) NOPASSWD /usr/bin/systemctl' > /tmp/xato
visudo -cf /tmp/xato 2>&1

/tmp/xato:1:45: syntax error
nodira ALL=(ALL) NOPASSWD /usr/bin/systemctl
                                            ^

Bitta ikki nuqta (:) tushib qolgan.

/etc/sudoers.d/ - to'g'ri joy #

ls /etc/sudoers.d/ | grep sinov
stat -c "%a %U:%G %n" /etc/sudoers.d/zz-sinov

zz-sinov
440 root:root /etc/sudoers.d/zz-sinov

Cheklangan huquq berish #

Amaliy misol: Nodira nginx ni qayta ishga tushira olsin, lekin boshqa hech nimani.

grep -A2 Cmnd_Alias /etc/sudoers.d/zz-sinov

Cmnd_Alias VEB = /usr/bin/systemctl restart nginx, \
                 /usr/bin/systemctl status nginx
nodira ALL=(root) NOPASSWD: VEB

nodira ALL=(root) NOPASSWD: systemctl restart nginx

nodira ALL=(root) NOPASSWD: /usr/bin/systemctl restart *

Jurnal - sudo ning eng katta afzalligi #

Har bir sudo chaqiruvi yoziladi: kim, qachon, qayerdan, qaysi katalogda va qaysi buyruq.

Sep 10 07:14:22 srv-01 sudo: malika : TTY=pts/1 ; PWD=/home/malika ;
  USER=root ; COMMAND=/usr/bin/systemctl restart nginx

13-bo'limda bu yozuvlarni journalctl bilan qidirishni o'rganamiz:

journalctl -t sudo --since "1 hour ago"

sudo: nodira : command not allowed ; TTY=pts/2 ;
  PWD=/home/nodira ; USER=root ; COMMAND=/usr/bin/systemctl stop mysql

Foydali sozlamalar #

sudo -l -U malika | grep -o 'env_reset'

env_reset

Root parolini o'chirish #

Ubuntu Serverda root parolsiz keladi - bu ataylab.

getent shadow root | cut -d: -f2

*

* - parol hech qachon o'rnatilmagan. Ya'ni root nomiga parol bilan kirishning iloji yo'q.

sudo passwd -l root

Xulosa #

• Root bo'lib ishlamang - sudo cheklaydi, yozadi va so'raydi.
• usermod -aG sudo - -a siz boshqa guruhlarni yo'qotasiz.
• Qoida shakli: kim - qayerda - kim bo'lib - parolsizmi - nima.
• Faqat visudo ishlating; u saqlashdan oldin tekshiradi.
• Sozlamalarni /etc/sudoers.d/ ga qo'ying, 440 va root:root.
• Fayl nomida nuqta bo'lmasin - u jimgina e'tiborsiz qoldiriladi.
• Buyruqni to'liq yo'l bilan yozing; jokerlardan qoching.
• vim, python, find, tar ga sudo bermang - ular qobiq ochadi.
• sudo o'zgartirayotganda ikkinchi SSH sessiyasi ochiq tursin.
• Muvaffaqiyatsiz urinishlar ham jurnalda - ularni kuzating.

Keyingi bo'limda SSH ni ko'ramiz: kalitlar, sozlama fayli va serverga kirishni qattiqlashtirish.