![尽管被阻止,用户仍能以 sudo 方式获取 root 权限](https://linux22.com/image/1517759/%E5%B0%BD%E7%AE%A1%E8%A2%AB%E9%98%BB%E6%AD%A2%EF%BC%8C%E7%94%A8%E6%88%B7%E4%BB%8D%E8%83%BD%E4%BB%A5%20sudo%20%E6%96%B9%E5%BC%8F%E8%8E%B7%E5%8F%96%20root%20%E6%9D%83%E9%99%90.png)
我在文件中有以下条目,sudoers
但用户可以访问根目录,因此需要阻止该操作。
Cmnd_Alias SUROOT=/bin/su -,/bin/su - root, /bin/su root, /usr/bin/su -, /usr/bin/su - root, /usr/bin/su root
kj ALL = (ALL) ALL,!SUROOT
但用户可以使用以下命令成为 root 用户
[kj@mytest-server1 ~]$ sudo su
[sudo] password for kj:
[root@mytest-server1 kj]#
我尝试阻止/bin/su
,但它阻止用户切换到任何用户。更改sudoers
kj 后,服务器如下
[root@mytest-server1 ~]# sudo -l -U kj
User kj may run the following commands on this host:
(ALL) ALL, (ALL) !/bin/su -, !/bin/su - root, !/bin/su root, !/usr/bin/su
-, !/usr/bin/su - root, !/usr/bin/su root, !/bin/su
[kj@mytest-server1 ~]$ sudo su - appeon
[sudo] password for kj:
Sorry, user kj is not allowed to execute '/bin/su - appeon' as root on mytest-server1.
[kj@mytest-server1 ~]$