Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_sudo_et_sudoers [2026/04/10 09:14] – Jean-Baptiste
+++ tech:notes_sudo_et_sudoers [2026/06/29 14:23] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon sudo }}
+Voir :
+* [[Pb sudo - Lenteur sudo]]
+* `man sudo_root`
+Voir aussi :
+* OpenDoas
+* runuser / setpriv (util-linux)
+* [sudoedit](http://bencane.com/2012/02/26/sudoedit-securely-allow-users-to-edit-files/)
+* sudoreplay
+* [Linux capabilities : se passer des commandes su et sudo](https://linuxfr.org/news/linux-capabilities-se-passer-des-commandes-su-et-sudo)
+* https://blog.guillaume-gomez.fr/Linux-tips/1/2
+* sux (su X11)
+* sudoers [[audit|Audit - list all users allow root privileges]]
+* [[Notes sécurité PAM|PAM]]
+* [[Ansible sudo su become_method]]
+* [[Notes userhelper - usermode]]
+* [gosu, setpriv, su-exec](https://github.com/tianon/gosu)
+* userhelper
+* `systemd-run -t bash` ou `systemd-run --shell`
+* Pourquoi ne pas utiliser sudo dans un contener : https://docsaid.org/en/blog/gosu-usage/
+* https://linuxfr.org/news/discussions-et-debats-sur-l-affichage-d-asterisques-a-la-saisie-du-mot-de-passe-par-sudo-rs
+# Notes sudo et sudoers
+**sudo** does `fork`+`exec` instead of just `exec`
+~~~bash
+visudo
+~~~
+~~~
+jean ALL=(test) NOPASSWD: ALL
+~~~
+Utilisation
+~~~bash
+sudo -u test -s /bin/bash
+echo 'ls /root/' | sudo -H -S -n bash
+~~~
+Test sudoers
+~~~bash
+sudo -l
+sudo -U username -l
+sudo -U username -ll
+~~~
+env_keep : Check environment variables sudo preserved :
+~~~bash
+sudo sudo -V
+~~~
+Restricting a sudo command to specific arguments
+~~~bash
+user  ALL=(root) NOPASSWD: /usr/bin/systemctl (stop|start|restart) (httpd|mysql)
+~~~
+Prohibiting Command Arguments with sudo
+Follow the program name with the single argument “” in /etc/sudoers:
+~~~bash
+smith  ALL = (root) /usr/local/bin/mycommand ""
+~~~
+## Exemple de Sudoers
+Accès root sans mdp pour un utilisateur
+~~~bash
+# export EDITOR=vim
+visudo -f /etc/sudoers.d/admin
+~~~
+`/etc/sudoers.d/admin`
+~~~
+jean        ALL=(ALL)       NOPASSWD: ALL
+~~~
+~~~
+#
+# Disable "ssh hostname sudo <cmd>", because it will show the password in clear.
+#         You have to run "ssh -t hostname sudo <cmd>".
+#
+Defaults    requiretty
+Host_Alias LOCAL_SERVER=servername
+Cmnd_Alias CHK_MSG=/usr/local/bin/check_msg.sh
+Defaults:nagios !requiretty
+nagios LOCAL_SERVER=(ALL) NOPASSWD: CHK_MSG
+~~~
+~~~
+operator ALL=(root) sudoedit /home/*/*/test.txt
+~~~
+~~~
+user1     ALL = NOPASSWD: /bin/ln -s /dev/ttyACM[1-9] /dev/ttyS[1-9]
+user1     ALL = NOPASSWD: /usr/bin/unlink /dev/ttyS[1-9]
+~~~
+Faire des groupes
+~~~bash
+sudo visudo -f /etc/sudoers.d/networking
+~~~
+~~~
+Cmnd_Alias     CAPTURE = /usr/sbin/tcpdump
+Cmnd_Alias     SERVERS = /usr/sbin/apache2ctl, /usr/bin/htpasswd
+Cmnd_Alias     NETALL = CAPTURE, SERVERS
+%netadmin ALL=NETALL
+~~~
+### Demander le mot de passe du compte root au lieu de l'utilisateur
+~~~
+Defaults rootpwc
+~~~
+### Demander le mot de passe x fois
+~~~bash
+Defaults passwd_tries=4
+~~~
+### Timeout
+~~~
+Defaults timestamp_timeout=x
+Defaults:peter timestamp_timeout=5
+~~~
+### Logs
+~~~
+Defaults logfile=/var/log/sudo.log
+~~~
+### Mails
+~~~
+#Defaults    mail_always
+Defaults    mail_badpass
+Defaults    mailto="<email@example.com>"
+~~~
+### PATH
+`/etc/sudoers`
+~~~
+Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
+~~~
+## Exemples sudoers
+### Exemple sudoedit
+`/etc/sudoers.d/sudoedit`
+~~~
+exploit    ALL=(root) NOPASSWD: sudoedit /var/log/*log
+exploit    ALL=(root) NOPASSWD: sudoedit /var/log/*.log.1
+exploit    ALL=(root) NOPASSWD: sudoedit /var/log/*err
+exploit    ALL=(root) NOPASSWD: sudoedit /var/log/*.gz
+~~~
+~~~bash
+export EDITOR=vim
+sudoedit /var/log/message.log
+sudo -e /var/log/message.log
+~~~
+### Alias
+~~~
+Cmnd_Alias ADMIN=/usr/bin/atop, /usr/bin/qps
+jean ALL= NOPASSWD: ADMIN
+~~~
+Voir [Sudo: You're Doing it Wrong](https://www.youtube.com/watch?v=o0purspHg-o)
+~~~
+Defaults insults
+# Users  Hosts = (Runas) Cmds
+# %Group Hosts = (Runas) Cmds
+%wheel ALL=(ALL) ALL
+Defaults env_keep+="HOME SSH_CLIENT SSH_CONNECTION SSH_TTY SSH_AUTH_SOCK"
+mwlucas dns1=ALL
+mwlucas,pkdick dns1,dns2 = \
+	/sbin/service names,/sbin/service syslogd
+mwlucas db1 = (oracle) ALL
+mwlucas dns[1-4]=ALL
+mwlucas ALL = /usr/local/sbin/*
+mwlucas ALL=/opt/bin/program -[acQ]
+# "" disallow arguments
+mwlucas ALL=/opt/bin/program ""
+Cmnd_Alias BACKUP = /sbin/dump,/sbin/restore,/usr/bin/mt
+mwlucas ALL=BACKUP
+User_Alias ADMIN_USERS = sysops,admin,sysadm
+User_Alias TAPEMONKEYS_USERS = mwlucas, jeanmm
+Host_Alias WWW = web1,web2,web3
+TAPEMONKEYS_USERS WWW=BACKUP
+Runas_Alias DB_RUNAS = oracle, pqsql, mysql
+fred DB_HOSTS = (DB_RUNAS) ALL
+DBA_USERS DB_HOSTS = (DB_RUNAS) ALL
+mwlucas ALL = NOEXEC: ALL
+Defaults!ALL NOEXEC
+Cmnd_Alias MAYEXEC = /bin/newaliases, /sbin/fdisk
+mwlucas ALL = ALL, EXEC: MAYEXEC
+mwlucas ALL = sudoedit /etc/rc.conf
+~~~
+~~~
+identifiant	ALL = (ALL) /chemin/complet/commande, NOPASSWD: /chemin/complet/autrecommande
+~~~
+Toutes les commandes situées à la droite du mot-clé NOPASSWD: peuvent être exécutées par l'utilisateur ou le groupe d'utilisateurs précisé en début d'instruction. Celles restées à sa gauche sont toujours soumises à l'authentification par mot de passe.
+~~~
+User_Alias USER_T_PLOP_ALL=user1
+USER_T_PLOP_ALL= (jean) EXEC: NOPASSWD: ALL
+#Runas_Alias=oracle, orainst, mysql, myinst
+~~~
+### Checksum
+Using openssl, to generate the checksum:
+~~~bash
+openssl dgst -sha224 /usr/local/sbin/mycommand
+~~~
+~~~
+SHA224(/usr/local/sbin/mycommand)= 52246fd78f692554c9f6be9c8ea001c9131c3426c27c88dbbad08365
+~~~
+Then in your sudoers file (on the same line):
+~~~
+ www-data ALL=(ALL) NOPASSWD:
+    sha224:52246fd78f692554c9f6be9c8ea001c9131c3426c27c88dbbad08365
+    /usr/local/sbin/mycommand
+~~~
+## Exemple sudo
+Get shell
+~~~bash
+sudo -u jean -i
+sudo -u jean -s
+sudo -u jean -s /bin/bash
+sudo su - jean
+~~~
+## PAM
+Source : https://www.tecmint.com/switch-user-account-without-password/
+Permette aux membres du groupe postgres d'impersonifier l'utilisateur postgres
+`/etc/pam.d/su`
+~~~
+auth       [success=ignore default=1] pam_succeed_if.so user = postgres
+auth       sufficient   pam_succeed_if.so use_uid user ingroup postgres
+~~~
+In the above configuration, the first line checks if the target user is postgres, if it is, the service checks the current user, otherwise, the `default=1` line is skipped and the normal authentication steps are executed.
+Équivalent à
+~~~
+%postgres ALL=NOPASSWD: /bin/su – postgres
+~~~
+## Autres
+### Ausible - become
+Voir :
+ * [[ansible_sudo_su_become_method|Ansible sudo su become_method become_flags]]
+~~~
+$ ansible-doc -t become ansible.builtin.sudo
+...
+become_flags
+default: -H -S -n
+...
+~~~
+## gosu, setpriv, su-exec, setuser (Python)
+Voir :
+* [gosu, setpriv, su-exec](https://github.com/tianon/gosu)
+* [setuser Python Script](https://github.com/phusion/baseimage-docker/blob/master/image/bin/setuser)
+Dans un container doit être appelé exec `exec`. Exemple :
+~~~bash
+exec gosu myAppUser /usr/local/bin/myApp --foo=bar
+~~~
+Exemples :
+* https://github.com/sudo-bmitch/jenkins-docker
+~~~bash
+gosu user-spec command [args]
+gosu tianon bash
+gosu nobody:root bash -c 'whoami && id'
+gosu 1000:1 id
+~~~
+~~~bash
+su-exec apache:1000 /usr/sbin/httpd -f /opt/www/httpd.conf
+~~~