sudo實例--企業生產環境用戶權限集中管理方案實例

           
根據角色的不一樣，給不一樣的用戶分配不一樣的角色
1.建立初級工程師3個，網絡工程師1個，中級工程師1個，經理1個
      #  批量建立用戶

for user in chuji{01..03} net01 senior01 manager01 
    > do
    >  useradd $user
    > echo "111111"|passwd --stdin $user
    > done;

2.建立5個開發人員，屬於phpers組
   

groupadd -g 999 phpers
    for n in `seq 5`
    do 
        useradd -g phpers php0$n
    done

3.建立開發經理，中級phper
  

 for user in kaifaManager seniorPhper
    > do
    > useradd $user
    > echo "111111"|passwd --stdin $user
    > done

4.編輯配置文件

[root@localhost ~]# vim /etc/sudoers
########################Cmnd_Alias By FTL ###################################
Cmnd_Alias CY_CMD_1=/usr/bin/free, /usr/bin/iostat,/usr/bin/top, /bin/hostname, /sbin/ifconfig, /bin/netstat, /sbin/route 
Cmnd_Alias GY_CMD_1=/usr/bin/free, /usr/bin/iostat,/usr/bin/top, /bin/hostname, /sbin/ifconfig, /bin/netstat, /sbin/route, /sbin/iptables, /etc/init.d/network, /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall, /bin/rpm, /usr/bin/updatedb, /usr/bin/yum, /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
Cmnd_Alias CK_CMD_1=/usr/bin/tail, /bin/grep, /var/log/messages*
Cmnd_Alias GK_CMD_1=/sbin/service, /sbin/chkconfig, /bin/tail, /var/log/*, /bin/grep, /bin/cat, /bin/ls, /bin/sh
Cmnd_Alias GW_CMD_1= /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /sbin/iwconfig, /sbin/mii-tool, /bin/cat, /var/log/*

########################User Aliases By FTL ###################################

User_Alias  CHUJI_YUNWEI_ADMINS=chuji01,chuji02,chuji03
User_Alias  CHUJI_KAIFA_ADMINS=php01,php02,php03,php04,php05
User_Alias  GAOJI_WANG_ADMINS=net01

########################Runas_Alias By FTL ###################################

Runas_Alias  OP = root     -->將來切換到某個角色執行任務

########################Config By FTL ###################################

senior01               ALL=(OP)      GY_CMD_1
manager01           ALL=(ALL)   NOPASSWD:ALL
kaifaManager        ALL=(ALL)   ALL, /usr/bin/passwd [A-Za-z], !/usr/bin/passwd root, !/usr/sbin/visudo,\
                                !/usr/bin/vi *sudoer*,  !/usr/bin/sudo su -, !/bin/su
seniorPhper            ALL=(OP)    GK_CMD_1
CHUJI_YUNWEI_ADMINS ALL=(OP)    CY_CMD_1
CHUJI_KAIFA_ADMINS  ALL=(OP)    CK_CMD_1
GAOJI_WANG_ADMINS   ALL=(OP)    GW_CMD_1

命令的路徑要全路徑  

別名須要大寫
超過一行，用"\"換行  
排除的命令必定在最後面寫
kaifaManager 由於有ALL,因此能夠直接su - 切換root,可是 sudo su -切換不了