# 1. 配置sudo日志
# vim /etc/sudoers
Defaults logfile=/var/log/sudo.log
Defaults log_year, log_host, log_input, log_output

# 2. 配置sudo超时
# vim /etc/sudoers
Defaults timestamp_timeout=5

# 3. 配置sudo尝试次数
# vim /etc/sudoers
Defaults passwd_tries=3

# 4. 配置sudo密码提示
# vim /etc/sudoers
Defaults passwd_prompt=”Password for %p@%h: ”

# 5. 配置sudo环境变量
# vim /etc/sudoers
Defaults env_reset
Defaults env_keep += “HOME PATH”

# 6. 配置sudo安全选项
# vim /etc/sudoers
Defaults !visiblepw
Defaults requiretty
Defaults umask=0027

# 7. 限制su命令
# vim /etc/pam.d/su
auth required pam_wheel.so use_uid

# 8. 检查sudo配置
# visudo -c
/etc/sudoers: parsed OK

# 9. 查看sudo日志
# cat /var/log/sudo.log
Apr 2 10:00:00 : fgedu : TTY=pts/0 ; PWD=/home/fgedu ; USER=root ; COMMAND=/bin/ls

# 10. 监控sudo使用
# auditctl -w /etc/sudoers -p wa -k sudo_config_changes
# ausearch -k sudo_config_changes

# 1. 创建权限审计脚本
# cat > /tmp/privilege_audit.sh << 'EOF' #!/bin/bash REPORT="/tmp/privilege_audit_report.txt" echo "========================================" > $REPORT
echo “Privilege Audit Report – $(date)” >> $REPORT
echo “========================================” >> $REPORT
echo “” >> $REPORT

# 1. 检查sudo配置
echo “1. Sudo Configuration” >> $REPORT
echo “———————” >> $REPORT
cat /etc/sudoers >> $REPORT
echo “” >> $REPORT

# 2. 检查sudoers.d目录
echo “2. Sudoers.d Configuration” >> $REPORT
echo “—————————” >> $REPORT
ls -l /etc/sudoers.d/ >> $REPORT
for file in /etc/sudoers.d/*; do
if [ -f “$file” ]; then
echo “File: $file” >> $REPORT
cat “$file” >> $REPORT
echo “” >> $REPORT
fi
done

# 3. 检查wheel组成员
echo “3. Wheel Group Members” >> $REPORT
echo “———————-” >> $REPORT
groupmems -g wheel -l >> $REPORT
echo “” >> $REPORT

# 4. 检查sudo日志
echo “4. Sudo Log” >> $REPORT
echo “———–” >> $REPORT
if [ -f /var/log/sudo.log ]; then
tail -n 20 /var/log/sudo.log >> $REPORT
else
echo “No sudo log found” >> $REPORT
fi
echo “” >> $REPORT

# 5. 检查用户sudo权限
echo “5. User Sudo Privileges” >> $REPORT
echo “———————–” >> $REPORT
for user in $(awk -F: ‘$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
echo “User: $user” >> $REPORT
sudo -U $user -l >> $REPORT 2>&1
echo “” >> $REPORT
done

echo “Audit completed. Report saved to $REPORT”
EOF

# 2. 执行审计脚本
# chmod +x /tmp/privilege_audit.sh
# /tmp/privilege_audit.sh
Audit completed. Report saved to /tmp/privilege_audit_report.txt

# 3. 查看审计报告
# cat /tmp/privilege_audit_report.txt

# 1. 切换到root用户
# su
Password:
# id
uid=0(root) gid=0(root) groups=0(root)

# 2. 切换到root用户（带环境变量）
# su –
Password:
# pwd
/root

# 3. 切换到指定用户
# su – fgedu
Password:
$ id
uid=1000(fgedu) gid=1000(fgedu) groups=1000(fgedu)

# 4. 以指定用户执行命令
# su – fgedu -c “whoami”
fgedu

# 5. 切换用户并执行多个命令
# su – fgedu -c “pwd; ls -l”
/home/fgedu
total 0

# 6. 切换到系统用户
# su – postgres -c “psql -c ‘SELECT version();'”
version
———————————————————————————————————-
PostgreSQL 16.0 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-4), 64-bit
(1 row)

# 7. 查看当前用户
# whoami
root

# 8. 查看用户ID
# id
uid=0(root) gid=0(root) groups=0(root)

# 9. 查看用户所属组
# groups
root

# 10. 切换用户并保持环境变量
# export MY_VAR=”test”
# su – fgedu -c “echo \$MY_VAR”
（无输出，环境变量未传递）

# su fgedu -c “echo \$MY_VAR”
test

# 11. 切换用户并设置环境变量
# su – fgedu -c “export MY_VAR=’test’; echo \$MY_VAR”
test

# 12. 切换用户并执行脚本
# cat > /tmp/test_script.sh << 'EOF' #!/bin/bash echo "Current user: $(whoami)" echo "Current directory: $(pwd)" echo "Home directory: $HOME" EOF # chmod +x /tmp/test_script.sh # su - fgedu -c "/tmp/test_script.sh" Current user: fgedu Current directory: /home/fgedu Home directory: /home/fgedu # 13. 检查su配置 # cat /etc/pam.d/su #%PAM-1.0 auth sufficient pam_rootok.so auth substack system-auth auth include postlogin account sufficient pam_succeed_if.so uid = 0 use_uid quiet account include system-auth password include system-auth session include system-auth session include postlogin session optional pam_xauth.so # 14. 限制su使用 # vim /etc/pam.d/su auth required pam_wheel.so use_uid # 15. 查看wheel组成员 # groupmems -g wheel -l fgedu user1

# 1. 以root身份执行命令
# sudo ls /root
[sudo] password for fgedu:
anaconda-ks.cfg initial-setup-ks.cfg

# 2. 以指定用户身份执行命令
# sudo -u fgedu whoami
fgedu

# 3. 以root身份执行命令（交互式）
# sudo -i
# whoami
root

# 4. 以root身份执行命令（非交互式）
# sudo -S ls /root <<< "password" anaconda-ks.cfg initial-setup-ks.cfg # 5. 查看当前用户sudo权限 # sudo -l Matching Defaults entries for fgedu on localhost: !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" User fgedu may run the following commands on localhost: (ALL) ALL # 6. 查看指定用户sudo权限 # sudo -U fgedu -l User fgedu may run the following commands on localhost: (ALL) ALL # 7. 以root身份编辑文件 # sudo vim /etc/hosts # 8. 以root身份执行多条命令 # sudo sh -c "ls /root; ls /home" anaconda-ks.cfg initial-setup-ks.cfg fgedu # 9. 以root身份执行后台命令 # sudo -b sleep 100 [1] 12345 # 10. 以root身份执行命令并保持环境变量 # sudo -E env | grep MY_VAR MY_VAR=test # 11. 以root身份执行命令并设置环境变量 # sudo MY_VAR=test env | grep MY_VAR MY_VAR=test # 12. 刷新sudo时间戳 # sudo -v [sudo] password for fgedu: # 13. 清除sudo时间戳 # sudo -k # 14. 验证sudo配置 # sudo -l -U fgedu User fgedu may run the following commands on localhost: (ALL) ALL # 15. 以root身份执行脚本 # cat > /tmp/test_sudo.sh << 'EOF' #!/bin/bash echo "Current user: $(whoami)" echo "Effective user: $(id -un)" echo "Real user: $(id -run)" EOF # chmod +x /tmp/test_sudo.sh # sudo /tmp/test_sudo.sh Current user: root Effective user: root Real user: root

# 1. 配置用户权限
# visudo
# 添加以下内容
fgedu ALL=(ALL) ALL

# 2. 配置组权限
# visudo
# 添加以下内容
%developers ALL=(ALL) /usr/bin/systemctl, /usr/bin/yum

# 3. 配置无密码权限
# visudo
# 添加以下内容
fgedu ALL=(ALL) NOPASSWD: ALL

# 4. 配置特定命令无密码
# visudo
# 添加以下内容
fgedu ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

# 5. 配置命令别名
# visudo
# 添加以下内容
Cmnd_Alias SOFTWARE = /usr/bin/rpm, /usr/bin/yum, /usr/bin/dnf
Cmnd_Alias SERVICES = /usr/bin/systemctl, /usr/sbin/service
Cmnd_Alias PROCESSES = /usr/bin/kill, /usr/bin/killall, /usr/bin/top

fgedu ALL=(ALL) SOFTWARE, SERVICES, PROCESSES

# 6. 配置用户别名
# visudo
# 添加以下内容
User_Alias ADMINS = fgedu, user1, user2
User_Alias WEBMASTERS = web1, web2

ADMINS ALL=(ALL) ALL
WEBMASTERS ALL=(ALL) /usr/bin/systemctl restart nginx

# 7. 配置主机别名
# visudo
# 添加以下内容
Host_Alias WEBSERVERS = web1, web2, web3
Host_Alias DBSERVERS = db1, db2

fgedu WEBSERVERS=(ALL) /usr/bin/systemctl restart nginx
fgedu DBSERVERS=(ALL) /usr/bin/systemctl restart mysql

# 8. 配置运行身份别名
# visudo
# 添加以下内容
Runas_Alias APP = app, nginx, mysql

fgedu ALL=(APP) /usr/bin/systemctl

# 9. 配置sudo日志
# visudo
# 添加以下内容
Defaults logfile=/var/log/sudo.log
Defaults log_year, log_host, log_input, log_output

# 10. 配置sudo超时
# visudo
# 添加以下内容
Defaults timestamp_timeout=5

# 11. 配置sudo密码尝试次数
# visudo
# 添加以下内容
Defaults passwd_tries=3

# 12. 配置sudo安全选项
# visudo
# 添加以下内容
Defaults !visiblepw
Defaults requiretty
Defaults umask=0027

# 13. 配置sudo环境变量
# visudo
# 添加以下内容
Defaults env_reset
Defaults env_keep += “HOME PATH”

# 14. 配置sudo包含文件
# visudo
# 添加以下内容
#includedir /etc/sudoers.d

# 15. 创建自定义配置文件
# cat > /etc/sudoers.d/custom << 'EOF' # Custom sudo configuration fgedu ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx %developers ALL=(ALL) /usr/bin/systemctl, /usr/bin/yum EOF # chmod 440 /etc/sudoers.d/custom

# 1. 运维人员sudo配置
# cat > /etc/sudoers.d/ops << 'EOF' # 运维人员权限配置 User_Alias OPS = ops1, ops2, ops3 # 系统管理权限 Cmnd_Alias SYSTEM = /usr/bin/systemctl, /usr/sbin/service, /usr/bin/journalctl # 软件管理权限 Cmnd_Alias SOFTWARE = /usr/bin/yum, /usr/bin/rpm, /usr/bin/dnf # 网络管理权限 Cmnd_Alias NETWORK = /usr/sbin/ip, /usr/sbin/ifconfig, /usr/sbin/route # 存储管理权限 Cmnd_Alias STORAGE = /usr/sbin/lvm, /usr/sbin/mkfs, /usr/bin/mount, /usr/bin/umount OPS ALL=(ALL) SYSTEM, SOFTWARE, NETWORK, STORAGE EOF # 2. 开发人员sudo配置 # cat > /etc/sudoers.d/dev << 'EOF' # 开发人员权限配置 User_Alias DEVS = dev1, dev2, dev3 # 应用管理权限 Cmnd_Alias APP = /usr/bin/systemctl restart app, /usr/bin/systemctl status app # 日志查看权限 Cmnd_Alias LOGS = /usr/bin/tail -f /var/log/app/*, /usr/bin/less /var/log/app/* # 部署权限 Cmnd_Alias DEPLOY = /opt/app/bin/deploy.sh, /opt/app/bin/rollback.sh DEVS ALL=(ALL) APP, LOGS, DEPLOY EOF # 3. 数据库管理员sudo配置 # cat > /etc/sudoers.d/dba << 'EOF' # 数据库管理员权限配置 User_Alias DBAS = dba1, dba2 # 数据库管理权限 Cmnd_Alias DATABASE = /usr/bin/systemctl restart mysql, /usr/bin/systemctl restart postgresql # 备份权限 Cmnd_Alias BACKUP = /usr/bin/mysqldump, /usr/bin/pg_dump, /usr/bin/pg_restore DBAS ALL=(ALL) DATABASE, BACKUP EOF # 4. 监控管理员sudo配置 # cat > /etc/sudoers.d/monitor << 'EOF' # 监控管理员权限配置 User_Alias MONITOR = monitor1, monitor2 # 监控服务权限 Cmnd_Alias MONITORING = /usr/bin/systemctl restart zabbix-agent, /usr/bin/systemctl restart prometheus # 日志查看权限 Cmnd_Alias LOGS = /usr/bin/tail -f /var/log/zabbix/*, /usr/bin/tail -f /var/log/prometheus/* MONITOR ALL=(ALL) MONITORING, LOGS EOF # 5. 应用用户sudo配置 # cat > /etc/sudoers.d/app << 'EOF' # 应用用户权限配置 app ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart app app ALL=(ALL) NOPASSWD: /usr/bin/systemctl status app EOF # 6. Web服务器sudo配置 # cat > /etc/sudoers.d/web << 'EOF' # Web服务器权限配置 User_Alias WEBMASTERS = web1, web2 # Nginx管理权限 Cmnd_Alias NGINX = /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx, /usr/bin/systemctl status nginx # 日志查看权限 Cmnd_Alias LOGS = /usr/bin/tail -f /var/log/nginx/*, /usr/bin/less /var/log/nginx/* WEBMASTERS ALL=(ALL) NGINX, LOGS EOF # 7. 安全加固sudo配置 # cat > /etc/sudoers.d/security << 'EOF' # 安全加固配置 Defaults logfile=/var/log/sudo.log Defaults log_year, log_host, log_input, log_output Defaults timestamp_timeout=5 Defaults passwd_tries=3 Defaults !visiblepw Defaults requiretty Defaults umask=0027 EOF # 8. 审计配置 # cat > /etc/sudoers.d/audit << 'EOF' # 审计配置 Defaults logfile=/var/log/sudo.log Defaults log_year, log_host, log_input, log_output EOF # 9. 测试配置 # visudo -c /etc/sudoers: parsed OK /etc/sudoers.d/app: parsed OK /etc/sudoers.d/audit: parsed OK /etc/sudoers.d/custom: parsed OK /etc/sudoers.d/dba: parsed OK /etc/sudoers.d/dev: parsed OK /etc/sudoers.d/monitor: parsed OK /etc/sudoers.d/ops: parsed OK /etc/sudoers.d/security: parsed OK /etc/sudoers.d/web: parsed OK # 10. 验证用户权限 # sudo -U fgedu -l User fgedu may run the following commands on localhost: (ALL) ALL (ALL) NOPASSWD: /usr/bin/systemctl restart nginx

# 1. 系统级sudo加固
# cat > /tmp/harden_sudo.sh << 'EOF' #!/bin/bash echo "Hardening sudo configuration..." # 备份原配置 cp /etc/sudoers /etc/sudoers.bak # 添加安全配置 cat >> /etc/sudoers << 'SUDOERS' # Security hardened sudo configuration Defaults logfile=/var/log/sudo.log Defaults log_year, log_host, log_input, log_output Defaults timestamp_timeout=5 Defaults passwd_tries=3 Defaults !visiblepw Defaults requiretty Defaults umask=0027 SUDOERS # 创建sudo日志文件 touch /var/log/sudo.log chmod 600 /var/log/sudo.log # 验证配置 visudo -c echo "Sudo hardened" EOF # 2. 限制su命令 # cat > /tmp/restrict_su.sh << 'EOF' #!/bin/bash echo "Restricting su command..." # 备份原配置 cp /etc/pam.d/su /etc/pam.d/su.bak # 添加限制 sed -i '/^#auth required pam_wheel.so use_uid/a auth required pam_wheel.so use_uid' /etc/pam.d/su # 检查wheel组成员 echo "Wheel group members:" groupmems -g wheel -l echo "Su command restricted" EOF # 3. 创建sudo审计脚本 # cat > /tmp/audit_sudo.sh << 'EOF' #!/bin/bash REPORT="/tmp/sudo_audit_report.txt" echo "Sudo Audit Report - $(date)" > $REPORT

# 检查sudo配置
echo “” >> $REPORT
echo “Sudo Configuration:” >> $REPORT
cat /etc/sudoers >> $REPORT

# 检查sudoers.d目录
echo “” >> $REPORT
echo “Sudoers.d Configuration:” >> $REPORT
for file in /etc/sudoers.d/*; do
if [ -f “$file” ]; then
echo “File: $file” >> $REPORT
cat “$file” >> $REPORT
echo “” >> $REPORT
fi
done

# 检查sudo日志
echo “” >> $REPORT
echo “Sudo Log:” >> $REPORT
if [ -f /var/log/sudo.log ]; then
tail -n 50 /var/log/sudo.log >> $REPORT
else
echo “No sudo log found” >> $REPORT
fi

echo “Audit completed. Report saved to $REPORT”
EOF

# 4. 监控sudo使用
# cat > /tmp/monitor_sudo.sh << 'EOF' #!/bin/bash LOG_FILE="/var/log/sudo_monitor.log" # 监控sudo使用 auditctl -w /usr/bin/sudo -p x -k sudo_usage auditctl -w /etc/sudoers -p wa -k sudo_config_changes auditctl -w /etc/sudoers.d/ -p wa -k sudo_config_changes echo "Sudo monitoring enabled" >> $LOG_FILE
EOF

# 5. 完整sudo安全加固
# cat > /tmp/full_sudo_hardening.sh << 'EOF' #!/bin/bash echo "Starting full sudo hardening..." # 1. 系统级sudo加固 ./harden_sudo.sh # 2. 限制su命令 ./restrict_su.sh # 3. 创建sudo审计脚本 ./audit_sudo.sh # 4. 监控sudo使用 ./monitor_sudo.sh echo "Full sudo hardening completed" EOF # chmod +x /tmp/full_sudo_hardening.sh # /tmp/full_sudo_hardening.sh

# 案例1：sudo命令执行失败
# 症状：用户执行sudo命令提示”Sorry, user is not allowed to execute”

# 排查步骤：
# 1. 检查用户sudo权限
# sudo -l
Sorry, user fgedu may not run sudo on localhost.

# 2. 检查sudo配置
# grep “fgedu” /etc/sudoers
（无输出）

# 3. 检查用户组
# groups fgedu
fgedu : fgedu

# 解决：添加sudo权限
# visudo
fgedu ALL=(ALL) ALL

# 案例2：sudo密码验证失败
# 症状：输入密码后提示”Sorry, try again”

# 排查步骤：
# 1. 检查用户密码
# passwd fgedu

# 2. 检查sudo配置
# grep “Defaults” /etc/sudoers

# 3. 检查PAM配置
# cat /etc/pam.d/sudo

# 解决：确保用户密码正确，检查PAM配置

# 案例3：sudo命令执行缓慢
# 症状：sudo命令执行非常缓慢

# 排查步骤：
# 1. 检查DNS解析
# cat /etc/resolv.conf

# 2. 检查主机名解析
# hostname
localhost.localdomain

# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain

# 解决：确保主机名可以正确解析

# 案例4：sudo配置语法错误
# 症状：visudo提示语法错误

# 排查步骤：
# 1. 检查配置语法
# visudo -c
/etc/sudoers: syntax error near line 100

# 2. 查看错误行
# sed -n ‘100p’ /etc/sudoers
fgedu ALL=(ALL) ALL ALL

# 解决：修复语法错误
# visudo
fgedu ALL=(ALL) ALL

# 案例5：sudo日志不记录
# 症状：sudo.log文件为空

# 排查步骤：
# 1. 检查sudo日志配置
# grep “logfile” /etc/sudoers
Defaults logfile=/var/log/sudo.log

# 2. 检查日志文件权限
# ls -l /var/log/sudo.log
-rw——-. 1 root root 0 Apr 2 10:00 /var/log/sudo.log

# 3. 检查日志配置
# grep “log_” /etc/sudoers
Defaults log_year, log_host, log_input, log_output

# 解决：确保日志配置正确，文件权限正确

# 案例6：su命令被拒绝
# 症状：执行su命令提示”Permission denied”

# 排查步骤：
# 1. 检查PAM配置
# grep “pam_wheel” /etc/pam.d/su
auth required pam_wheel.so use_uid

# 2. 检查用户组
# groups fgedu
fgedu : fgedu

# 解决：添加用户到wheel组
# usermod -aG wheel fgedu

# 案例7：sudo环境变量丢失
# 症状：sudo执行命令时环境变量丢失

# 排查步骤：
# 1. 检查环境变量
# export MY_VAR=”test”
# sudo env | grep MY_VAR
（无输出）

# 2. 检查sudo配置
# grep “env_keep” /etc/sudoers
Defaults env_keep += “HOME PATH”

# 解决：添加环境变量到env_keep
# visudo
Defaults env_keep += “MY_VAR”

# 案例8：sudo命令被拦截
# 症状：执行sudo命令提示”command not found”

# 排查步骤：
# 1. 检查sudo路径
# which sudo
/usr/bin/sudo

# 2. 检查PATH环境变量
# echo $PATH
/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin

# 解决：确保sudo在PATH中

# 案例9：sudo权限过大
# 症状：用户拥有过多权限

# 排查步骤：
# 1. 检查用户权限
# sudo -l
User fgedu may run the following commands on localhost:
(ALL) ALL

# 解决：限制用户权限
# visudo
fgedu ALL=(ALL) /usr/bin/systemctl, /usr/bin/yum

# 案例10：sudo时间戳问题
# 症状：每次执行sudo都需要输入密码

# 排查步骤：
# 1. 检查时间戳配置
# grep “timestamp_timeout” /etc/sudoers
Defaults timestamp_timeout=5

# 2. 检查时间戳文件
# ls -l /run/sudo/ts/
total 0

# 解决：确保时间戳配置正确，检查时间戳目录权限