Linux 系统中 sudo 命令的 10 个技巧
sudo su
![](/data/attachment/album/201804/19/014018aaiy499x4ygca02x.jpg)


### 概览


`sudo` 表示 “**s**uper**u**ser **do**”。 它允许已验证的用户以其他用户的身份来运行命令。其他用户可以是普通用户或者超级用户。然而，大部分时候我们用它来以提升的权限来运行命令。


`sudo` 命令与安全策略配合使用，默认安全策略是 `sudoers`，可以通过文件 `/etc/sudoers` 来配置。其安全策略具有高度可拓展性。人们可以开发和分发他们自己的安全策略作为插件。


### 与 su 的区别


在 GNU/Linux 中，有两种方式可以用提升的权限来运行命令：


* 使用 `su` 命令
* 使用 `sudo` 命令


`su` 表示 “**s**witch **u**ser”。使用 `su`，我们可以切换到 root 用户并且执行命令。但是这种方式存在一些缺点：


* 我们需要与他人共享 root 的密码。
* 因为 root 用户为超级用户，我们不能授予受控的访问权限。
* 我们无法审查用户在做什么。


`sudo` 以独特的方式解决了这些问题。


1. 首先，我们不需要妥协来分享 root 用户的密码。普通用户使用他们自己的密码就可以用提升的权限来执行命令。
2. 我们可以控制 `sudo` 用户的访问，这意味着我们可以限制用户只执行某些命令。
3. 除此之外，`sudo` 用户的所有活动都会被记录下来，因此我们可以随时审查进行了哪些操作。在基于 Debian 的 GNU/Linux 中，所有活动都记录在 `/var/log/auth.log` 文件中。


本教程后面的部分阐述了这些要点。


### 实际动手操作 sudo


现在，我们对 sudo 有了大致的了解。让我们实际动手操作吧。为了演示，我使用 Ubuntu。但是，其它发行版本的操作应该是相同的。


#### 允许 sudo 权限


让我们添加普通用户为 `sudo` 用户吧。在我的情形中，用户名为 `linuxtechi`。


1) 按如下所示编辑 `/etc/sudoers` 文件：



```
$ sudo visudo

```

2) 添加以下行来允许用户 `linuxtechi` 有 sudo 权限：



```
linuxtechi ALL=(ALL) ALL

```

上述命令中：


* `linuxtechi` 表示用户名
* 第一个 `ALL` 指示允许从任何终端、机器访问 `sudo`
* 第二个 `(ALL)` 指示 `sudo` 命令被允许以任何用户身份执行
* 第三个 `ALL` 表示所有命令都可以作为 root 执行


#### 以提升的权限执行命令


要用提升的权限执行命令，只需要在命令前加上 `sudo`，如下所示：



```
$ sudo cat /etc/passwd

```

当你执行这个命令时，它会询问 `linuxtechi` 的密码，而不是 root 用户的密码。


#### 以其他用户执行命令


除此之外，我们可以使用 `sudo` 以另一个用户身份执行命令。例如，在下面的命令中，用户 `linuxtechi` 以用户 `devesh` 的身份执行命令：



```
$ sudo -u devesh whoami
[sudo] password for linuxtechi:
devesh

```

#### 内置命令行为


`sudo` 的一个限制是 —— 它无法使用 Shell 的内置命令。例如， `history` 记录是内置命令，如果你试图用 `sudo` 执行这个命令，那么会提示如下的未找到命令的错误：



```
$ sudo history
[sudo] password for linuxtechi:
sudo: history: command not found


```

**访问 root shell**


为了克服上述问题，我们可以访问 root shell，并在那里执行任何命令，包括 Shell 的内置命令。


要访问 root shell, 执行下面的命令:



```
$ sudo bash

```

执行完这个命令后——您将观察到提示符变为井号（`#`）。


### 技巧


这节我们将讨论一些有用的技巧，这将有助于提高生产力。大多数命令可用于完成日常任务。


#### 以 sudo 用户执行之前的命令


让我们假设你想用提升的权限执行之前的命令，那么下面的技巧将会很有用：



```
$ sudo !4

```

上面的命令将使用提升的权限执行历史记录中的第 4 条命令。


#### 在 Vim 里面使用 sudo 命令


很多时候，我们编辑系统的配置文件时，在保存时才意识到我们需要 root 访问权限来执行此操作。因为这个可能让我们丢失我们对文件的改动。没有必要惊慌，我们可以在 Vim 中使用下面的命令来解决这种情况：



```
:w !sudo tee %

```

上述命令中：


* 冒号 (`:`) 表明我们处于 Vim 的退出模式
* 感叹号 (`!`) 表明我们正在运行 shell 命令
* `sudo` 和 `tee` 都是 shell 命令
* 百分号 (`%`) 表明从当前行开始的所有行


#### 使用 sudo 执行多个命令


至今我们用 `sudo` 只执行了单个命令，但我们可以用它执行多个命令。只需要用分号 (`;`) 隔开命令，如下所示：



```
$ sudo -- bash -c 'pwd; hostname; whoami'


```

上述命令中


* 双连字符 (`--`) 停止命令行切换
* `bash` 表示要用于执行命令的 shell 名称
* `-c` 选项后面跟着要执行的命令


#### 无密码运行 sudo 命令


当第一次执行 `sudo` 命令时，它会提示输入密码，默认情形下密码被缓存 15 分钟。但是，我们可以避免这个操作，并使用 `NOPASSWD` 关键字禁用密码认证，如下所示：



```
linuxtechi ALL=(ALL) NOPASSWD: ALL

```

#### 限制用户执行某些命令


为了提供受控访问，我们可以限制 `sudo` 用户只执行某些命令。例如，下面的行只允许执行 `echo` 和 `ls` 命令 。



```
linuxtechi ALL=(ALL) NOPASSWD: /bin/echo /bin/ls

```

#### 深入了解 sudo


让我们进一步深入了解 `sudo` 命令。



```
$ ls -l /usr/bin/sudo
-rwsr-xr-x 1 root root 145040 Jun 13  2017 /usr/bin/sudo

```

如果仔细观察文件权限，则发现 `sudo` 上启用了 setuid 位。当任何用户运行这个二进制文件时，它将以拥有该文件的用户权限运行。在所示情形下，它是 root 用户。


为了演示这一点，我们可以使用 `id` 命令，如下所示：



```
$ id
uid=1002(linuxtechi) gid=1002(linuxtechi) groups=1002(linuxtechi)

```

当我们不使用 `sudo` 执行 `id` 命令时，将显示用户 `linuxtechi` 的 id。



```
$ sudo id
uid=0(root) gid=0(root) groups=0(root)


```

但是，如果我们使用 `sudo` 执行 `id` 命令时，则会显示 root 用户的 id。


### 结论


从这篇文章可以看出 —— `sudo` 为普通用户提供了更多受控访问。使用这些技术，多用户可以用安全的方式与 GNU/Linux 进行交互。




---


via: <https://www.linuxtechi.com/quick-tips-sudo-command-linux-systems/>


作者：[Pradeep Kumar](https://www.linuxtechi.com/author/pradeep/) 译者：[szcf-weiya](https://github.com/szcf-weiya) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
### Overview

**sudo** stands for **superuser do**. It allows authorized users to execute command as an another user. Another user can be regular user or superuser. However, most of the time we use it to execute command with elevated privileges.

sudo command works in conjunction with security policies, default security policy is sudoers and it is configurable via **/etc/sudoers** file. Its security policies are highly extendable. One can develop and distribute their own policies as plugins.

#### How it’s different than su

In GNU/Linux there are two ways to run command with elevated privileges:

- Using
**su**command - Using
**sudo**command

**su** stands for **switch user**. Using su, we can switch to root user and execute command. But there are few drawbacks with this approach.

- We need to share root password with another user.
- We cannot give controlled access as root user is superuser
- We cannot audit what user is doing.

sudo addresses these problems in unique way.

- First of all, we don’t need to compromise root user password. Regular user uses its own password to execute command with elevated privileges.
- We can control access of sudo user meaning we can restrict user to execute only certain commands.
- In addition to this all activities of sudo user are logged hence we can always audit what actions were done. On Debian based GNU/Linux all activities are logged in
**/var/log/auth.log**file.

Later sections of this tutorial sheds light on these points.

#### Hands on with sudo

Now, we have fair understanding about sudo. Let us get our hands dirty with practical. For demonstration, I am using Ubuntu. However, behavior with another distribution should be identical.

#### Allow sudo access

Let us add regular user as a sudo user. In my case user’s name is linuxtechi

1) Edit /etc/sudoers file as follows:

$ sudo visudo

2) Add below line to allow sudo access to user linuxtechi:

linuxtechi ALL=(ALL) ALL

In above command:

- linuxtechi indicates user name
- First ALL instructs to permit sudo access from any terminal/machine
- Second (ALL) instructs sudo command to be allowed to execute as any user
- Third ALL indicates all command can be executed as root

#### Execute command with elevated privileges

To execute command with elevated privileges, just prepend sudo word to command as follows:

$ sudo cat /etc/passwd

When you execute this command, it will ask linuxtechi’s password and not root user password.

#### Execute command as an another user

In addition to this we can use sudo to execute command as another user. For instance, in below command, user linuxtechi executes command as a devesh user:

$ sudo -u devesh whoami [sudo] password for linuxtechi: devesh

#### Built in command behavior

One of the limitation of sudo is – Shell’s built in command doesn’t work with it. For instance, history is built in command, if you try to execute this command with sudo then command not found error will be reported as follows:

$ sudo history [sudo] password for linuxtechi: sudo: history: command not found

**Access root shell**

To overcome above problem, we can get access to root shell and execute any command from there including Shell’s built in.

To access root shell, execute below command:

$ sudo bash

After executing this command – you will observe that prompt sign changes to pound (#) character.

**Recipes**

In this section we’ll discuss some useful recipes which will help you to improve productivity. Most of the commands can be used to complete day-to-day task.

#### Execute previous command as a sudo user

Let us suppose you want to execute previous command with elevated privileges, then below trick will be useful:

$ sudo !4

Above command will execute 4th command from history with elevated privileges.

If you want to execute the previous command with root privileges using sudo command, then use following command,

$ sudo !!

#### sudo command with Vim

Many times we edit system’s configuration files and while saving we realize that we need root access to do this. Because this we may lose our changes. There is no need to get panic, we can use below command in Vim to rescue from this situation:

:w !sudo tee %

In above command:

- Colon (:) indicates we are in Vim’s ex mode
- Exclamation (!) mark indicates that we are running shell command
- sudo and tee are the shell commands
- Percentage (%) sign indicates all lines from current line

#### Execute multiple commands using sudo

So far we have executed only single command with sudo but we can execute multiple commands with it. Just separate commands using semicolon (;) as follows:

$ sudo -- bash -c 'pwd; hostname; whoami'

In above command:

- Double hyphen (–) stops processing of command line switches
- bash indicates shell name to be used for execution
- Commands to be executed are followed by –c option

#### Run sudo command without password

When sudo command is executed first time then it will prompt for password and by default password will be cached for next 15 minutes. However, we can override this behavior and disable password authentication using NOPASSWD keyword as follows:

linuxtechi ALL=(ALL) NOPASSWD: ALL

#### Restrict user to execute certain commands

To provide controlled access we can restrict sudo user to execute only certain commands. For instance, below line allows execution of echo and ls commands only

linuxtechi ALL=(ALL) NOPASSWD: /bin/echo /bin/ls

#### Append line or text string to a file using sudo command

There are some scenarios where we to append a few lines to a existing file with local user who has sudo rights,

$ echo ‘text-string’ | sudo tee -a <path_of_file>

Example is shown below :

pkumar@linuxtechi:~$ echo "deb http://ftp.de.debian.org/debian buster main contrib" | sudo tee -a /etc/apt/sources.list deb http://ftp.de.debian.org/debian buster main contrib pkumar@linuxtechi:~$

Alternate way to append lines or text to existing file using sudo command,

sudo sh -c 'echo "deb http://ftp.de.debian.org/debian buster main contrib" >> /etc/apt/sources.list'

#### Insights about sudo

Let us dig more about sudo command to get insights about it.

$ ls -l /usr/bin/sudo -rwsr-xr-x 1 root root 145040 Jun 13 2017 /usr/bin/sudo

If you observe file permissions carefully, **setuid** bit is enabled on sudo. When any user runs this binary it will run with the privileges of the user that owns the file. In this case it is root user.

To demonstrate this, we can use id command with it as follows:

$ id uid=1002(linuxtechi) gid=1002(linuxtechi) groups=1002(linuxtechi)

When we execute id command without sudo then id of user linuxtechi will be displayed.

$ sudo id uid=0(root) gid=0(root) groups=0(root)

But if we execute id command with sudo then id of root user will be displayed.

#### Conclusion

Takeaway from this article is – sudo provides more controlled access to regular users. Using these techniques multiple users can interact with GNU/Linux in secure manner.

Read Also : [How to Create Hard and Soft (symlink) Links on Linux Systems](https://www.linuxtechi.com/tips-hard-soft-links-linux-unix-systems/)

Vince SHI always include the following lines in my /etc/sudoers:

Defaults logfile = /var/log/sudo.log, log_host, log_year

Defaults log_input, log_output, iolog_dir = /var/log/sudo-io/%{user}

The first line just adds hostname and the year parameter in /var/log/sudo.log. For viewing the logs from multiple servers, these parameters allow easier queries by hostname and date.

The second line is where the magic happens. This line tells sudo to log all input and output of each session. Using the sudoreplay command, I can replay any sudo session as though I was watching it happen live. The sudoreplay is great when people come to you and say, “I don’t know what I did, but something is broken.” Using the sudoreplay command, you will know EXACTLY what that person did.