Configuring privilege escalation with sudo

Sudo allows users to run applications and scripts with the security privileges of another user.

Getting ready

Before allowing someone to elevate their security context for a specific application or script, you need to figure out which user or group you wish to elevate from and to, which applications/scripts you use, and on which systems to run them.

The default syntax for a sudo entry is the following:

who where = (as_whom) what

How to do it…

These simple five steps will guide you through setting up privilege escalation:

  1. Create a new sudoers definition file in /etc/sudoers.d/ called clustering through the following command:
    ~]# visudo -f /etc/sudoers.d/clustering
  2. Create a command alias for the most-used clustering tools called CLUSTERING by executing the following:
    Cmnd_Alias CLUSTERING = /sbin/ccs, /sbin/clustat, /sbin/clusvcadm
  3. Now, create a host alias group for all the clusters called CLUSTERS, as follows:
    Host_Alias CLUSTERS = cluster1, cluster2
  4. Next, create a user alias for all cluster admins called CLUSTERADMINS by executing the following:
    User_Alias CLUSTERADMINS = spalpatine, dvader, okenobi, qjinn
  5. Now, let's create a sudo rule that allows the users from CLUSTERADMINS to execute commands from CLUSTERING on all servers within the CLUSTERS group, as follows:
    CLUSTERADMINS CLUSTERS = (root) CLUSTERING

There's more…

To edit the sudoers file, you can either use a text editor and edit /etc/sudoers, the visudo tool, which automatically checks your syntax when exiting.

It's always a good idea to leave the original /etc/sudoers file alone and modify the files located in /etc/sudoers.d/. This allows the sudo rpm to update the sudoers file should it be necessary.

See also

For more information about sudo, take a look at the sudoers (5) man page.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset