Paw*_*ski 39 permissions security sudo users user-management
能否请您指导我查看 /etc/sudoers.d/ 上的一些示例和更详细的说明
我想授予某些组权限以 sudo 某些命令，但以适当的方式不要在多用户计算机上的 Ubuntu 安全模型中创建不必要的漏洞。
在古代我做了一些简单的 sudoers 定制，但显然现在 /etc/sudoers.d/ 是一种更合适的方式，我想更好地理解它。
Paw*_*ski 58
正如这个问题所说，/etc/sudoers是一个系统范围的配置文件，可以通过系统升级自动更改，并且对于不正确的更改非常脆弱。如果更改不当，您可能会失去访问权限或使系统无法启动。
$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
(... some other content ...)
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
与您可能期望的相反，该#includedir指令不是 comment。它的作用是sudo读取和解析目录中的任何文件/etc/sudoers.d（不以“~”结尾或包含“.”字符）。
$ ls -l /etc/sud*
-r--r----- 1 root root 755 sty 20 17:03 /etc/sudoers
/etc/sudoers.d:
total 7
-r--r----- 1 root root 958 mar 30 2016 README
$ sudo cat /etc/sudoers.d/README
#
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
#
# #includedir /etc/sudoers.d
#
# This will cause sudo to read and parse any files in the /etc/sudoers.d
# directory that do not end in '~' or contain a '.' character.
#
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
#
# Note also, that because sudoers contents can vary widely, no attempt is
# made to add this directive to existing sudoers files on upgrade. Feel free
# to add the above directive to the end of your /etc/sudoers file to enable
# this functionality for existing installations if you wish!
#
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo for more information.
#
与/etc/sudoers，/etc/sudoers.d生存系统升级的内容不同，因此最好在那里创建文件而不是修改/etc/sudoers.
您可能希望使用以下visudo命令编辑此目录中的文件：
$ sudo visudo -f /etc/sudoers.d/veracrypt
GNU nano 2.5.3 File: /etc/sudoers.d/veracrypt.tmp
# Users in the veracryptusers group are allowed to run veracrypt as root.
%veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt
请注意，visudo可能使用不同的编辑器，而不是nano如https://help.ubuntu.com/community/Sudoers 所述
以下是我发现有用的一些链接：
| 归档时间： |
|
| 查看次数： |
95048 次 |
| 最近记录： |