我正在尝试这样配置sudo，以便从特定 IP 范围连接时无需输入密码。我尝试在文件中使用以下行来实现此目的/etc/sudoers：
%wheel 10.1.2.0/24 = (ALL) NOPASSWD: ALL
visudo当我关闭它时没有给出错误，所以语法是有效的。但是当我使用 wheel 组中的用户从 ip 范围内的服务器登录时10.1.2.0/24，我仍然需要提供该帐户的密码：
[cybertinus@server ~]$ id
uid=500(cybertinus) gid=500(cybertinus) groups=500(cybertinus),10(wheel),48(apache)
[cybertinus@server ~]$ who
cybertinus pts/0 2015-09-30 09:57 (10.1.2.3)
cybertinus pts/1 2015-09-30 13:03 (10.1.2.3)
[cybertinus@server ~]$ sudo -i
[sudo] password for cybertinus:
/var/log/secure然而，我注意到的是，当我在此提示符下输入错误的密码时，会添加以下行：
Sep 30 13:04:31 server sudo: pam_unix(sudo-i:auth): authentication failure; logname=cybertinus uid=500 euid=0 tty=/dev/pts/1 ruser=cybertinus rhost= user=cybertinus
rhost=是空的。所以我的理论是 sudo 不会从 ssh 会话传递远程主机。有没有办法让我们sudo知道这个交互式ssh会话正在从哪个主机运行？
我确实知道这存在安全风险。但问题中的 IP 范围是我在 VPN 网络中使用的 IP 范围。换句话说：它不直接连接到互联网。如果黑客入侵我的 VPN 网络，我就会遇到另一个问题 ;)。
为了让您了解完整的情况，这是我的完整/etc/sudoers文件：
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
##
## This file must be edited with the 'visudo' command.
## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using
## wildcards for entire domains) or IP addresses instead.
# Host_Alias FILESERVERS = fs1, fs2
# Host_Alias MAILSERVERS = smtp, smtp2
## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem
## Command Aliases
## These are groups of related commands...
## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb
## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe
# Defaults specification
#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear.
# You have to run "ssh -t hostname sudo <cmd>".
#
#Defaults requiretty
#
# Refuse to run if unable to disable echo on the tty. This setting should also be
# changed in order to be able to use sudo without a tty. See requiretty above.
#
Defaults !visiblepw
#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults always_set_home
Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults env_keep += "HOME"
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
## Allows people in group wheel to run all commands
%wheel 10.1.2.3=(ALL) NOPASSWD: ALL
%wheel ALL=(ALL) ALL
## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
## Allows members of the users group to shutdown this system
# %users localhost=/sbin/shutdown -h now
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
/etc/sudoers.d您会在末尾看到对的引用。这是该目录的内容：
[root@server ~]# ls /etc/sudoers.d | wc -l
0
换句话说：/etc/sudoers.d没有任何东西可以推翻正常/etc/sudoers文件。
答案1
主机列表功能sudo检查/匹配执行主机的主机名、IP 地址、网络号、网络组sudo，而不是远程主机的主机名、IP 地址、网络组。
这个想法是，单个通用sudoers文件可以分发到大量的服务器/工作站，并且某些权限仅授予系统子集上的用户。
查看底部的示例部分手动的
# /etc/sudoers
# Runas alias specification
Runas_Alias OP = root, operator
# Host alias specification
Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
SGI = grolsch, dandelion, black :\
ALPHA = widget, thalamus, foobar :\
HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns
# example users
jack CSNETS = ALL
jen ALL, !SERVERS = ALL
bob SPARC = (OP) ALL : SGI = (OP) ALL
用户 jack 可以在 CSNETS 别名中的机器（网络 128.138.243.0、128.138.204.0 和 128.138.242.0）上运行任何命令。在这些网络中，只有 128.138.204.0 具有明确的网络掩码（以 CIDR 表示法表示），表明它是 C 类网络。对于 CSNETS 中的其他网络，将在匹配期间使用本地机器的网络掩码。
用户 bob 可以以 OP Runas_Alias 中列出的任何用户（root 和 operator）的身份在 SPARC 和 SGI 机器上运行任何程序。
用户 jen 可以在除 SERVERS Host_Alias（master、mail、www 和 ns）中的命令之外的任何机器上运行任何命令。