Sudo/zh-cn

命令提供了一个简单和安全的方式来配置权限提升——比如让普通用户以 或其他用户身份运行某些（甚至全部）命令，而不需要提供密码.

为了允许某些用户在系统上执行某些管理步骤而不授予他们全部 root 权限，使用 是最好的选择. 使用 可以控制谁可以做什么. 本指南简要介绍了这个强大的工具.

此文章仅是一个快速介绍，包远比这里描述的要强大. 它还有其他特殊功能，譬如以其他用户身份编辑文件 ，从脚本内部运行（这样它就可以在后台运行，从标准输入中读取密码而不是从键盘）……等等.

更多信息请阅读 和 手册.

记录活动
One additional advantage of is that it can log any attempt (successful or not) to run an application. This is very useful when tracking who made that one fatal mistake that took 10 hours to fix :)

授予权限
The package allows the system administrator to grant permission to other users to execute one or more applications they would normally have no right to. Unlike using the  bit on these applications  gives a more fine-grained control on who can execute a certain command and when.

With a clear list can be made of who can execute a certain application. If the setuid bit is set on an executable, any user would be able to run the application (or any user of a certain group, depending on the permissions used). With the user can (and probably should) be required to provide a password in order to execute the application.

The configuration is managed by the  file.

基础语法
最难的部分是 的语法. 基本语法如下：

This line tells that the user, identified by   and logged in on the system , can execute the command   (which can also be a comma-separated list of allowed commands).

A more real-life example might make this more clear: To allow the user to execute  when he is logged in on :

The user name can also be substituted with a group name, in which case the name is prefaced by a  sign. For instance, to allow any one in the group to execute :

To enable more than one command for a given user on a given machine, multiple commands can be listed on the same line. For instance, to allow to not only run  but also  and  as root:

The precise command line can also be specified (including parameters and arguments) not just the name of the executable. This is useful to restrict the use of a certain tool to a specified set of command options. The tool allows shell-style wildcards (AKA meta or glob characters) to be used in path names as well as command-line arguments in the sudoers file. Note that these are not regular expressions.

Here is an example of from the perspective of a first-time user of the tool who has been granted access to the full power of :

The password that requires is the user's own password. This is to make sure that no terminal that is accidentally left open to others is abused for malicious purposes.

LDAP 的基本语法
LDAP 需要  和   USE 标志的支持.

将 sudo 与 LDAP 一起使用时，sudo 也会从 LDAP 服务器读取配置. 所以需要编辑两个文件.

需要为 sudo 添加以下 LDAP 条目.

The configuration on the sudoer on LDAP are similar to files with some different. Please read more about sudo with LDAP on the link below.

使用别名
In larger environments having to enter all users over and over again (or hosts, or commands) can be a daunting task. To ease the administration of aliases can defined. The format to declare aliases is quite simple:

One alias that always works, for any position, is the  alias (to make a good distinction between aliases and non-aliases it is recommended to use capital letters for aliases). The  alias is an alias to all possible settings.

A sample use of the  alias to allow any user to execute the  command if he is logged on locally is:

Another example is to allow the user to execute the  command as root, regardless of where he is logged in from:

More interesting is to define a set of users who can run software administrative applications (such as and ) on the system and a group of administrators who can change the password of any user, except root!

Non-root execution
It is also possible to have a user run an application as a different, non-root user. This can be very interesting when running applications as a different user (for instance for the web server) and want to allow certain users to perform administrative steps as that user (like killing zombie processes).

Inside list the user(s) in between   and   before the command listing:

For instance, to allow to run the  tool as the  or  user:

With this set, the user can run to select the user he wants to run the application as:

An alias can set for the user to run an application as using the  directive. Its use is identical to the other  directives we have seen before.

Passwords and default settings
By default, asks the user to identify himself using his own password. Once a password is entered, remembers it for 5 minutes, allowing the user to focus on his tasks and not repeatedly re-entering his password.

Of course, this behavior can be changed: set the  directive in  to change the default behavior for a user.

For instance, to change the default 5 minutes to 0 (never remember):

A setting of  would remember the password indefinitely (until the system reboots).

A different setting would be to require the password of the user that the command should be run as and not the users' personal password. This is accomplished using. In the following example we also set the number of retries (how many times the user can re-enter a password before fails) to   instead of the default 3:

另一个有趣的功能是保持  变量集，以便可以执行图形工具：

Dozens of default settings can changed using the  directive. Fire up the manual page and search for.

To allow a user to run a certain set of commands without providing any password whatsoever, start the commands with, like so:

Bash completion
Users that want bash completion with sudo need to run this once.

Zshell completion
Users that want zsh completion for sudo can set the following in and  respectively

With the above change, all commands in the, and  locations will be available to the shell for completion when the command is prefaced with 'sudo'.

列出权限
要列出当前用户的能力，请运行 ：

在 中的任何命令不需要输入密码，也不需要密码来列出条目. 对于其它命令，sudo 会要求输入密码.

延长密码超时时间
默认情况下，如果用户输入了他们的密码以向 验证他们自己，它会被记住 5 分钟. 如果用户想延长这段时间，他可以运行 来重置时间戳，这样  在再次要求输入密码之前还需要 5 分钟.

反之则是使用 终止时间戳.