2.3 sudo与PAM认证
sudo
sudo命令允许一个通过sudoers文件指定的授权用户作为超级用户或者另外一个用户来执行命令。
语法：sudo [-u 用户] 命令
选项：
-u user 默认为root
-l,ll 列出用户在主机上可用的和被禁止的命令
-v 再延长密码有效期限5分钟,更新时间戳
-k 清除时间戳（1970-01-01），下次需要重新输密码
-K 与-k类似，还要删除时间戳文件
-b 在后台执行指令
查看 /etc/sudoers 文件，在配置 sudo 时，建议按照 /etc/sudoers 的格式存放在 /etc/sudoers.d 中。
[root@CentOS7 ~]# cat /etc/sudoers
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
##
## This file must be edited with the 'visudo' command.
## Host Aliases #主机别名
## Groups of machines. You may prefer to use hostnames (perhaps using
## wildcards for entire domains) or IP addresses instead.
# Host_Alias FILESERVERS = fs1, fs2
# Host_Alias MAILSERVERS = smtp, smtp2
## User Aliases #用户别名
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem
## Command Aliases #命令别名
## These are groups of related commands...
## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb
## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe
# Defaults specification
#
# Refuse to run if unable to disable echo on the tty.
#
Defaults !visiblepw
#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults always_set_home
Defaults match_group_by_gid
Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults env_keep += "HOME"
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
#授权root用户在任何主机代替任何用户，执行任何命令
## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL #建议删除
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
## Allows members of the users group to shutdown this system
# %users localhost=/sbin/shutdown -h now
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d授权语法：授权用户 主机=(代替用户) 命令
注意：命令要写命令文件的绝对路径，并且命令参数必须完全一致。
root ALL=(ALL) ALL 的存在意义：当 root 用户的 UID 被修改，不再是超级用户，root用户可以通过 sudo 命令的 -u 选项拥有管理员权限取执行操作。
在 /etc/suoders.d 中创建 sudo 配置文件，格式与授权语法一样。
在修改 /etc/sudoers 文件时，默认此文件是只读权限，建议使用 visudo 命令，也可以通过设置 export EDITOR=vim 变量来更改系统默认的文本编辑器。
visudo命令用于修改或者检查 sudo 的配置文件。
[root@CentOS7 sudoers.d]# cat jiangbowen
jiangbowen 192.168.30.75=(root) /bin/cat /etc/shadow
[root@CentOS7 sudoers.d]# visudo -c -f jiangbowen #使用-c选项检查语法，使用-f指定文件
jiangbowen: parsed OK
[jiangbowen@CentOS7 ~]$ sudo cat /etc/shadow
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
[sudo] password for jiangbowen: 在配置文件中支持使用 glob 风格的通配符。
注意：当配置文件中出现类似语句时
jiangbowen 192.168.30.75=(root) /bin/cat /etc/shadow*那么该用户可以通过 cat /etc/shadow 后跟任何文件来查看权限以外的文件
时间戳文件 CentOS7存放在 /var/run/sudo/ts CentOS6存放在 /var/db/sudo，默认权限保存5分钟，在5分钟以后会重新检查用户的身份。
[root@CentOS7 sudo]# cd /var/run/sudo/ts
[root@CentOS7 ts]# ll
total 4
-rw-------. 1 root jiangbowen 80 May 25 04:22 jiangbowen #jiangbowen用户在04:27后使用sudo将会重新输入密码查看 sudo 的日志文件 /var/log/secure
[root@CentOS7 ts]#⮀cat /var/log/secure | tail
May 25 04:16:59 CentOS7 su: pam_unix(su-l:session): session opened for user jiangbowen by root(uid=0)
May 25 04:17:10 CentOS7 su: pam_unix(su-l:session): session closed for user jiangbowen
May 25 04:21:14 CentOS7 su: pam_unix(su-l:session): session opened for user jiangbowen by root(uid=0)
May 25 04:21:57 CentOS7 unix_chkpwd[11231]: password check failed for user (jiangbowen)
May 25 04:21:57 CentOS7 sudo: pam_unix(sudo:auth): authentication failure; logname=root uid=1000 euid=0 tty=/dev/pts/0 ruser=jiangbowen rhost= user=jiangbowen
May 25 04:22:00 CentOS7 sudo: pam_unix(sudo:auth): conversation failed
May 25 04:22:00 CentOS7 sudo: pam_unix(sudo:auth): auth could not identify password for [jiangbowen]
May 25 04:22:02 CentOS7 sudo: jiangbowen : 1 incorrect password attempt ; TTY=pts/0 ; PWD=/home/jiangbowen ; USER=root ; COMMAND=/bin/cat /etc/shadow
May 25 04:22:09 CentOS7 sudo: jiangbowen : TTY=pts/0 ; PWD=/home/jiangbowen ; USER=root ; COMMAND=/bin/cat /etc/shadow
May 25 04:26:06 CentOS7 su: pam_unix(su-l:session): session closed for user jiangbowen别名
sudo 有四种类型的别名：：User_Alias, Runas_Alias, Host_Alias ，Cmnd_Alias(注意大小写)
语法：别名类型 名字1 = 项目1,项目2,项目3...:名字2 = 项目1,项目2,项目3...
User_Alias Name1 = user1,#uid2: Name2 = user3,#uid4 Host_Alias Name2=www.jiangbowen.com.cn,192.168.30.74/24Cmnd_Alias DSKCMD=/sbin/parted,/sbin/fdiskPAM认证机制
PAM 提供了对所有服务进行认证的中央机制，适用于login，远程登录（telnet,rlogin,fsh,ftp,点对点协议（PPP）），su等应用程序中。系统管理员通过PAM配置文件来制定不同应用程序的不同认证策略；应用程序开发者通过在服务程序中使用PAM API(pam_xxxx( ))来实现对认证方法的调用；而PAM服务模块的开发者则利用PAM SPI来编写模块（主要是引出一些函数pam_sm_xxxx( )供PAM接口库调用），将不同的认证机制加入到系统中；PAM接口库（libpam）则读取配置文件，将应用程序和相应的PAM服务模块联系起来。
PAM的基本构架
[root@CentOS7 ts]# cd /etc/security/
[root@CentOS7 security]# ll
total 52
-rw-r--r--. 1 root root 4564 Apr 11 11:21 access.conf
-rw-r--r--. 1 root root 82 Apr 11 11:21 chroot.conf
drwxr-xr-x. 2 root root 69 May 23 01:15 console.apps
-rw-r--r--. 1 root root 604 Apr 11 11:21 console.handlers
-rw-r--r--. 1 root root 939 Apr 11 11:21 console.perms
drwxr-xr-x. 2 root root 6 Apr 11 11:21 console.perms.d
-rw-r--r--. 1 root root 3635 Apr 11 11:22 group.conf
-rw-r--r--. 1 root root 2422 Apr 11 11:22 limits.conf
drwxr-xr-x. 2 root root 27 May 23 01:11 limits.d
-rw-r--r--. 1 root root 1440 Apr 11 11:22 namespace.conf
drwxr-xr-x. 2 root root 6 Apr 11 11:22 namespace.d
-rwxr-xr-x. 1 root root 1019 Apr 11 11:22 namespace.init
-rw-------. 1 root root 0 Apr 11 11:22 opasswd
-rw-r--r--. 1 root root 2972 Apr 11 11:21 pam_env.conf
-rw-r--r--. 1 root root 1718 Dec 7 2011 pwquality.conf
-rw-r--r--. 1 root root 419 Apr 11 11:22 sepermit.conf
-rw-r--r--. 1 root root 2179 Apr 11 11:22 time.conf
PAM 模块文件存放在 /lib64/security/ 中
各个软件的 PAM 配置文件存放在 /etc/pam.d/ 中。通用的配置文件存放在件 /etc/pam.conf，默认不存在
PAM的工作原理
PAM认证首先要确定那一项服务，然后加载相应的PAM的配置文件(/etc/pam.d)，最后调用认证文件(/lib/security)进行安全认证。
查看软件的 PAM 配置文件
[root@CentOS7 pam.d]# cat passwd
#%PAM-1.0
auth include system-auth
account include system-auth
password substack system-auth
-password optional pam_gnome_keyring.so use_authtok
password substack postlogin语法：模块类型 控制 模块路径 [参数]
模块类型：
Auth：账号的认证和授权
Account：与账号管理相关的非认证类的功能，如：用来限制/允许用户对某个服务的访问时间，当前有效的系统资源(最多可以有多少个用户)，限制用户的位置(例如：root用户只能从控制台登录)
Password：用户修改密码时密码复杂度检查机制等功能
Session：用户获取到服务之前或使用服务完成之后需要进行一些附加的操作，如：记录打开/关闭数据的信息，监视目录等
-[模块类型]：表示因为缺失而不能加载的模块将不记录到系统日志,对于那些不总是安装在系统上的模块有用
控制：
required：一票否决，表示本模块必须返回成功才能通过认证，但是如果该模块返回失败，失败结果也不会立即通知用户，而是要等到同一type中的所有模块全部执行完毕再将失败结果返回给应用程序。即为必要条件
requisite：一票否决，该模块必须返回成功才能通过认证，但是一旦该模块返回失败，将不再执行同一type内的任何模块，而是直接将控制权返回给应用程序。是一个必要条件
sufficient：一票通过，表明本模块返回成功则通过身份认证的要求，不必再执行同一type内的其它模块，但如果本模块返回失败可忽略，即为充分条件
optional：表明本模块是可选的，它的成功与否不会对身份认证起关键作用，其返回值一般被忽略
include： 调用其他的配置文件中定义的配置信息
注意：修改PAM配置文件将马上生效，所以建议编辑pam规则时，保持至少打开一个root会话，以防止root身份验证错误
常用 PAM 模块
[root@CentOS7 ~]#⮀ls /lib64/security/ #查看当前系统所有PAM模块
pam_access.so pam_echo.so pam_fprintd.so pam_lastlog.so pam_motd.so pam_pwquality.so pam_shells.so pam_timestamp.so pam_unix.so
pam_cap.so pam_env.so pam_ftp.so pam_limits.so pam_namespace.so pam_rhosts.so pam_sss.so pam_tty_audit.so pam_userdb.so
pam_chroot.so pam_exec.so pam_gdm.so pam_listfile.so pam_nologin.so pam_rootok.so pam_stress.so pam_umask.so pam_warn.so
pam_console.so pam_faildelay.so pam_gnome_keyring.so pam_localuser.so pam_oddjob_mkhomedir.so pam_securetty.so pam_succeed_if.so pam_unix_acct.so pam_wheel.so
pam_cracklib.so pam_faillock.so pam_group.so pam_loginuid.so pam_permit.so pam_selinux_permit.so pam_systemd.so pam_unix_auth.so pam_xauth.so
pam_debug.so pam_filter pam_issue.so pam_mail.so pam_postgresok.so pam_selinux.so pam_tally2.so pam_unix_passwd.so
pam_deny.so pam_filter.so pam_keyinit.so pam_mkhomedir.so pam_pwhistory.so pam_sepermit.so pam_time.so pam_unix_session.so pam_shells.so 模块会检查用户使用的 shell 类型，使用不在 /etc/shells 文件中的 shell 都将认证失败。
[root@CentOS7 ~]# grep pam_shells.so /etc/pam.d/* #查看使用pam_shells.so的程序
/etc/pam.d/vmtoolsd:auth required pam_shells.so
/etc/pam.d/vmtoolsd:account required pam_shells.so在 su 程序中添加 pam_shells.so 模块
[root@CentOS7 pam.d]# cat su
#%PAM-1.0
auth required pam_shells.so #将pam_shells.so放在第一行，提高优先级
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth substack system-auth
auth include postlogin
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session include postlogin
session optional pam_xauth.so将 /ect/shells 文件中的 /bin/csh 行删除后，使用 su 命令切换用户使用 csh
[root@CentOS7 pam.d]# cat /etc/shells #文件中没有/bin/csh
/bin/sh
/bin/bash
/sbin/nologin
/usr/bin/sh
/usr/bin/bash
/usr/sbin/nologin
/bin/tcsh
[root@CentOS7 pam.d]#⮀usermod -s /bin/csh jiangbowen #将jiangbowen用户的默认shell修改为csh
[root@CentOS7 pam.d]#⮀su - jiangbowen #当使用su时，jiangbowen用户无法登陆
Password:
su: Authentication failure
[root@CentOS7 pam.d]# echo /bin/csh >> /etc/shells #在文件中添加/bin/csh
[root@CentOS7 pam.d]# su - jiangbowen #切换至使用csh的用户成功
Last login: Fri May 25 04:21:14 CST 2018 on pts/0
Last failed login: Sat May 26 03:49:20 CST 2018 on pts/0
There was 1 failed login attempt since the last successful login.
[jiangbowen@CentOS7 ~]$ pam_securetty.so 模块会检查 root 用户只能在 /etc/securetty 中列出的终端登陆
[root@CentOS7 pam.d]# grep pam_securetty.so /etc/pam.d/*
/etc/pam.d/login:auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
/etc/pam.d/remote:auth required pam_securetty.so查看 /etc/securetty 后，发现没有 pts 类型的终端
[root@CentOS7 pam.d]# telnet 192.168.30.75 #通过telnet使用root登陆
Trying 192.168.30.75...
Connected to 192.168.30.75.
Escape character is '^]'.
Kernel 3.10.0-862.el7.x86_64 on an x86_64
CentOS7 login: root
Password:
Login incorrect #登陆失败
[root@CentOS7 pam.d]# echo pts/1 >> /etc/securetty #在/etc/securetty中添加pts类型终端
[root@CentOS7 pam.d]# echo pts/2 >> /etc/securetty
[root@CentOS7 pam.d]# echo pts/3 >> /etc/securetty
[root@CentOS7 pam.d]# telnet 192.168.30.75
Trying 192.168.30.75...
Connected to 192.168.30.75.
Escape character is '^]'.
Kernel 3.10.0-862.el7.x86_64 on an x86_64
CentOS7 login: root #使用root登陆
Password:
Last failed login: Sat May 26 04:09:44 CST 2018 from ::ffff:192.168.30.75 on pts/1
There were 5 failed login attempts since the last successful login.
Last login: Fri May 25 17:24:52 from 192.168.30.1 #登陆成功
pam_nologin.so 模块会检查 /etc/nologin 是否存在，如果存在，非root用户将不能登陆，并且会显示 /etc/nologin 中的内容。
[root@CentOS7 pam.d]#⮀grep pam_nologin.so /etc/pam.d/* #查看使用pam_nologin.so的程序
/etc/pam.d/gdm-autologin:account required pam_nologin.so
/etc/pam.d/gdm-fingerprint:account required pam_nologin.so
/etc/pam.d/gdm-password:account required pam_nologin.so
/etc/pam.d/gdm-pin:account required pam_nologin.so
/etc/pam.d/gdm-smartcard:account required pam_nologin.so
/etc/pam.d/login:account required pam_nologin.so
/etc/pam.d/pluto:account required pam_nologin.so
/etc/pam.d/ppp:account required pam_nologin.so
/etc/pam.d/remote:account required pam_nologin.so
/etc/pam.d/sshd:account required pam_nologin.so[root@CentOS7 pam.d]# echo "I don't welcome you here" > /etc/nologin #创建/etc/nologin文件
[root@CentOS7 pam.d]# cat /etc/nologin #查看/etc/nologin文件中的内容
I don't welcome you here
pam_limits.so 模块会控制用户可用资源的限制。
[root@CentOS7 pam.d]#⮀grep pam_limits.so /etc/pam.d/*
/etc/pam.d/fingerprint-auth:session required pam_limits.so
/etc/pam.d/fingerprint-auth-ac:session required pam_limits.so
/etc/pam.d/password-auth:session required pam_limits.so
/etc/pam.d/password-auth-ac:session required pam_limits.so
/etc/pam.d/runuser:session required pam_limits.so
/etc/pam.d/smartcard-auth:session required pam_limits.so
/etc/pam.d/smartcard-auth-ac:session required pam_limits.so
/etc/pam.d/sudo:session required pam_limits.so
/etc/pam.d/sudo-i:session required pam_limits.so
/etc/pam.d/system-auth:session required pam_limits.so
/etc/pam.d/system-auth-ac:session required pam_limits.so在 pam_limits.so 模块的配置文件 /etc/security/limits.conf 中设置指定用户的资源限制。
语法：对象 资源类型 资源 数值
对象：UserName 单用户；@GroupName 用户组；*所有用户
资源类型：Soft 软限制，用户可以调整；Hard 硬限制，用户不能限制；- 二者同时设定
资源：nofile 所能够同时打开的最大文件数量,默认为1024
nproc 所能够同时运行的进程的最大数量,默认为1024....（具体查看官方文档）
也可以通过 ulimit 命令进行限制用户的资源
查看当前资源的限制[root@CentOS7 pam.d]#⮀ulimit -a
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 5438
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 1024 #当前最大打开文件数为默认1024个
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 5438
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited使用 ab 工具向192.168.30.75发起1025个并发连接
[root@CentOS7 pam.d]# ab -c 1025 -n 2000 http://192.168.30.75/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 192.168.30.75 (be patient)
socket: Too many open files (24) #套接字文件提示文件数量太多通过 -n 选项调整打开文件的数量
[root@CentOS7 pam.d]# ulimit -n 1200 #将打开文件数量的最大值调整为1200
[root@CentOS7 pam.d]# ulimit -a
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 5438
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 1200 #调整成功
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 5438
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
[root@CentOS7 pam.d]#⮀ab -c 1025 -n 2000 http://192.168.30.75/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 192.168.30.75 (be patient) #连接成功
Completed 200 requests
Completed 400 requests
Completed 600 requests
Completed 800 requests
Completed 1000 requests
Completed 1200 requests
Completed 1400 requests
Completed 1600 requestspam_limits.so 模块可以限制的系统资源，与对应 ulinmit 命令的选项
