目前sudo
会提示输入密码,但之后什么也不会发生。没有任何错误。
我已经检查了 sudoers 文件,它通过了 visudo 语法检查,以下是设置:
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
该文件的权限为 0440。我已将自己添加到sudo
和admin
组中。
当我尝试使用 Sudo 时,它看起来是这样的:
kml@rhythmsdev:/etc$ sudo apt-get update
kml@rhythmsdev:/etc$
如您所见,没有任何错误。它只是返回到提示。
这是文件权限
-r--r----- 1 root root 723 Feb 1 10:10 sudoers
sudoers.d
drwxr-xr-x 2 root root 4096 Feb 4 16:46 .
id
下面是我尝试让 Sudo 在其下工作的其中一个用户的输出:
uid=1010(kml) gid=102(develop) groups=102(develop),4(adm),27(sudo),106(admin),110(ftp)
我如何进行升级。
我使用 SSH 进行了升级do-release-upgrade -d
,但可以通过穿过走廊进行物理访问。
以下是 /etc/sources.list 的内容
#
# deb cdrom:[Ubuntu-Server 10.04 LTS _Lucid Lynx_ - Release i386 (20100427)]/ lucid main restricted
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main restricted
## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise universe
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
## Uncomment the following two lines to add software from the 'backports'
## repository.
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb http://us.archive.ubuntu.com/ubuntu/ lucid-backports main restricted universe multiverse
# deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-backports main restricted universe multiverse
## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu lucid partner
# deb-src http://archive.canonical.com/ubuntu lucid partner
deb http://security.ubuntu.com/ubuntu precise-security main restricted
deb-src http://security.ubuntu.com/ubuntu precise-security main restricted
deb http://security.ubuntu.com/ubuntu precise-security universe
deb-src http://security.ubuntu.com/ubuntu precise-security universe
deb http://security.ubuntu.com/ubuntu precise-security multiverse
deb-src http://security.ubuntu.com/ubuntu precise-security multiverse
# deb http://security.ubuntu.com/ubuntu maverick-security main universe
目录:/etc/apt/sources.list.d
为空。
lsb_release -a
是
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 12.04.1 LTS
Release: 12.04
Codename: precise
apt-cache policy sudo
是:
sudo:
Installed: 1.8.3p1-1ubuntu3.3
Candidate: 1.8.3p1-1ubuntu3.3
Version table:
*** 1.8.3p1-1ubuntu3.3 0
500 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main i386 Packages
100 /var/lib/dpkg/status
1.8.3p1-1ubuntu3.2 0
500 http://security.ubuntu.com/ubuntu/ precise-security/main i386 Packages
1.8.3p1-1ubuntu3 0
500 http://us.archive.ubuntu.com/ubuntu/ precise/main i386 Packages
type -a sudo
是
sudo is /usr/bin/sudo
sha256sum $(which sudo)
是
0efd358e04ea07dc73b67642d9bb85f49143c65996a7c88a57b42557a0b0a50d /usr/bin/sudo
pkexec echo success
做过这个:
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/echo' as the super user
Multiple identities can be used for authentication:
1. My Name,,, (me)
2. ,Account used for Git,, (git)
3. Coworker1,,, (cw1)
4. Coworker2,,, (cw2)
5. Coworker3,,, (cw3)
6. My Name,,, (me)
7. Coworker4,,, (cw4)
8. Coworker5,,, (cw5)
9. ,Account used for Git,, (git)
Choose identity to authenticate as (1-9): 1
Password:
==== AUTHENTICATION COMPLETE ===
success
为了保护大多数无辜者,名字都已更改。出于某种原因,我出现了两次。但其他同事也不能使用 Sudo(那些可以预先升级的同事)。
以下是另外几个命令的输出。
visudo sudoers 文件并
kml ALL=(ALL:ALL) ALL
在 root 行下添加
sudo -i echo success
和以前一样,什么也没有。
echo foo | sudo tee foo.txt; ls -l foo.txt
得到:
ls: cannot access foo.txt: No such file or directory
我如何重新安装 Sudo。
我已经完成了两次。
我第一次运行
apt-get install --reinstall sudo
--从 root
这没有什么效果,所以我首先通过以下方式卸载
apt-get uninstall sudo
:
apt-get install sudo
编辑更多信息,已重新编辑
sudo
密码验证后返回静默并且不再询问。
sudo -k
并且sudo -K
也静默失败我以 root 身份登录,它会提示在普通帐户上输入密码。
更多信息 2
我跑了tail -f /var/log/auth.log
sudo ls
以下是我的 kml 帐户的输出
Feb 6 16:33:27 rhythmsdev sudo: pam_unix(sudo:session): session opened for user root by kml(uid=1010)
Feb 6 16:33:27 rhythmsdev sudo: pam_unix(sudo:session): session closed for user root
尝试输入错误的密码会提示输入新密码,并记录此
Feb 6 16:35:17 rhythmsdev sudo: pam_unix(sudo:auth): authentication failure; logname=kml uid=1010 euid=0 tty=/dev/pts/0 ruser=kml rhost= user=kml
ed3
sudo apt-get clean && sudo apt-get update && sudo apt-get --purge --reinstall install sudo
Sudo 仍然不起作用。输出如下
apt-get install --purge --reinstall sudo
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
mono-2.0-gac libxcb-aux0 python-fstab libgnomekbd4 libts-0.0-0 libwpd8c2a libcdio10 xsltproc pnm2ppa librpmbuild0 libcolamd2.7.1 lp-solve libglitz-glx1 openoffice.org-writer libntfs10 python-gnome2 libxcb-render-util0 libevent-1.4-2
gnome-media gnome-desktop-data libgtk-vnc-1.0-0 libgnomepanel2.24-cil xulrunner-1.9.2 libxcb-event1 libindicator0 linux-headers-2.6.32-38 libicu42 openoffice.org-draw libdbusmenu-glib1 ubufox python-aptdaemon-gtk openoffice.org-gtk
libsilc-1.1-2 libgnome-media0 libbeagle1 g++-4.4 libexchange-storage1.2-3 libgraphite3 libwpg-0.1-1 libibus1 libproxy0 libnm-util1 python-gtksourceview2 libevview2 scrollkeeper libindicate-gtk2 libwebkit-1.0-2
libmono-system-runtime2.0-cil libpisock9 libdns64 libcamel1.2-14 bcmwl-modaliases librpmio0 librpm0 libgnome2-perl libaccess-bridge-java-jni libstdc++6-4.4-dev libeggdbus-1-0 libnspr4-0d libgtkhtml-editor0 esound-common
python-pyorbit gdebi-core libnotify1 python-telepathy libedata-cal1.2-6 libaccess-bridge-java libdevkit-power-gobject1 gnome-media-common librasqal2 libpango1.0-common ubuntuone-client-gnome cups-driver-gutenprint libgadu3
openoffice.org-style-human libmono-cairo2.0-cil libisccc60 cpu-checker libgweather1 python-gtkspell libgnome-bluetooth7 libxxf86misc1 libloudmouth1-0 libsexy2 libxcb-atom1 libido-0.1-0 libgmime2.4-cil compiz-plugins libffi5
libgnome-pilot2 libdirectfb-1.2-0 openoffice.org-style-galaxy libgssdp-1.0-2 libcryptui0 finger libmusicbrainz4c2a python-pyatspi libgp11-0 libjs-mootools python-webkit libgcr0 libqt4-webkit libcdio-cdda0 libhunspell-1.2-0 liblwres60
libgmp3c2 libgtksourceview2.0-common openoffice.org-math libhal1 libgtksourceview2.0-0 hal libgnome2-vfs-perl libprotobuf5 libesd0 openoffice.org-common libegroupwise1.2-13 libdbusmenu-gtk1 libgsf-1-common gnome-doc-utils
libecal1.2-7 at-spi libpoppler5 libgmime-2.4-2 libgdata1.2-1 libedataserver1.2-11 libhal-storage1 libpython2.6 gnome-system-monitor libmldbm-perl libbind9-60 libimobiledevice0 libgtkmm-2.4-1c2a libglitz1 libevdocument2
libgdata-google1.2-1 libspeechd2 fglrx-modaliases libnunit2.4-cil libclutter-gtk-0.10-0 libebook1.2-9 libmagickcore2 libaudiofile0 libwps-0.1-1 libedataserverui1.2-8 nvidia-173-modaliases libphonon4 libgnome-window-settings1
libedata-book1.2-2 libgdata6 libxss1 libgs8 openoffice.org-emailmerge libappindicator0 liblpint-bonobo0 ntfsprogs libjpeg62 libgtkhtml-editor-common libqt4-designer libmpfr1ldbl libcdio-paranoia0 libmysqlclient16 libmagickwand2
libisccfg60 libfreezethaw-perl smartdimmer libgupnp-1.0-3 screen-resolution-extra libnl1 libanthy0 tsconf liboobs-1-4 libgucharmap7 libgksu2-0 libdb4.7 libsilcclient-1.1-3 libindicate4 libndesk-dbus-glib1.0-cil libraptor1 python-wnck
liboil0.3 libebackend1.2-0 firefox-branding hal-info speech-dispatcher libgnome-desktop-2-17 fuse-utils python-desktopcouch gwibber libisc60 libnice0 linux-headers-2.6.32-38-generic libnautilus-extension1 compiz-fusion-plugins-main
gnome-applets-data min12xxw libwebkit-1.0-common libavahi-ui0 libprotoc5 nvidia-96-modaliases libavahi-core6 libgupnp-igd-1.0-2 libgnome2-canvas-perl libgtkhtml3.14-19 libgsf-1-114 python-rdflib gnome-panel-data libpoppler-glib4
libpisync1 libdotconf1.0 python-indicate
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 16 not upgraded.
Need to get 292 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main sudo i386 1.8.3p1-1ubuntu3.3 [292 kB]
Fetched 292 kB in 0s (742 kB/s)
(Reading database ... 310429 files and directories currently installed.)
Preparing to replace sudo 1.8.3p1-1ubuntu3.3 (using .../sudo_1.8.3p1-1ubuntu3.3_i386.deb) ...
Unpacking replacement sudo ...
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Setting up sudo (1.8.3p1-1ubuntu3.3) ...
编辑4
sha256sum /usr/lib/sudo/sudoers.so /usr/lib/sudo/sudo_noexec.so
结果是
6f2e56e05d9a3de942558255b72d59a147be2c637247e244c365838378fe6ec3 /usr/lib/sudo/sudoers.so
7db6a45129ec1ef6d4cb21d7a488a85f5b45e4d21990116f64c9e71f116648c0 /usr/lib/sudo/sudo_noexec.so
以另一个用户身份执行 Sudo 操作(以 root 身份运行)
root@rhythmsdev:/home/kml# sudo -u kml echo success
root@rhythmsdev:/home/kml#
编辑 5
使用 Eliah Kagan 提供的脚本这里我检查了重复的组和 ID。所有差异都显示为空白。
编辑 6
strace echo success
这里
编辑7
root@rhythmsdev:/home/kml# sudo echo success
root@rhythmsdev:/home/kml# echo $?
1
编辑8
这看起来很有趣,这与具有工作 sudo 的服务器不同
root@rhythmsdev:/home/kml# sudo -l
Matching Defaults entries for root on this host:
env_reset,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User root may run the following commands on this host:
(ALL : ALL) ALL
(ALL) ALL
root@rhythmsdev:/home/kml#
这是我作为 root
我以我的身份(非 root)
kml@rhythmsdev:~$ sudo -l
[sudo] password for kml:
Matching Defaults entries for kml on this host:
env_reset,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User kml may run the following commands on this host:
(ALL : ALL) ALL
(ALL) ALL
(ALL : ALL) ALL
kml@rhythmsdev:~$
谢谢你,
我现在没有什么主意了。
答案1
这太令人失望了……
我可以通过更改 sudoers 文件中的一行来修复它。
我改变了这一行
Defaults env_reset
我把它改成了
Defaults !env_reset
这是因为我注意到 sudo -E 正在工作。所以我做了一些研究,找到了一种防止 sudo 清除环境变量的方法。到目前为止,这似乎已经解决了问题。我需要做的是找出需要保留哪个环境变量,然后使用 env_keep+= 添加它
感谢大家的帮助和支持,我会继续更新。我不确定之前是否有人建议过 sudo -E,请告诉我,我会将赏金奖励给那个人。
编辑1
因此我可能会因 !env_reset 而产生安全问题。我会继续更新。
答案2
检查您是否在管理员组中。
您可以使用 Linux CD 启动救援启动并修复问题。
修改 sudoers 文件时应始终使用 visudo。visudo 将在保存 sudo 文件之前检查其语法,从而保护您免受此特定问题的困扰(但不会阻止您编写禁止您运行 sudo 的 sudoers 文件!)
请注意,sudoers 通常设置为即使在 Ubuntu 上也无法由 root 写入:
-r--r----- 1 root root 600 2012-06-18 18:00 sudoers
sudoers 文件的文件保护或所有权不再正确。该文件必须由用户 root 和组 root 拥有,并且文件保护应为:0440 (u=r, g=r, o-rwx)。
chown root:root /etc/sudoers
chmod u=r,g=r,o= /etc/sudoers
chown -R root:root /etc/sudoers.d
chmod u=rwx,g=rx,o=rx /etc/sudoers.d/
chmod u=r,g=r,o= /etc/sudoers.d/*
该文件应该只对 root 用户和 root 组具有读取权限,其他任何人都无权访问。该目录必须对所有人和 root 组具有 rx 权限,但只有 root 用户才具有对该目录的写入权限。