Linux sudo 提权异常的情况

这一篇主要记录几个关于 sudo 提权失败或者执行异常的情况

情况一 用户未添加到 /etc/sudoers

这种情况报错如下，处理办法就是评估一下这个用户是否需要提权，在/etc/sudoers 里面配置即可

# sudo su -
username is not in the sudoers file.  This incident will be reported.

---

情况二 提权密码失败次数多被锁定

情况描述：sudo 提权的时候密码输入错误次数过多，被一些认证机制锁了，报错如下

sudo su -
[sudo] password for username: 
Sorry, try again.
[sudo] password for username: 
...
Account locked due to 19 failed logins
Password: 
su: Authentication failure

解决办法：通过其他有权限的用户执行失败次数重置的操作

pam_tally2 -u username --reset

相关信息：

man pam_tally2 
This module maintains a count of attempted accesses, 
can reset count on success, can deny access if too many attempts fail.

Add the following line to /etc/pam.d/login to lock the account after 4 failed logins. 
Root account will be locked as well. The accounts will be
       automatically unlocked after 20 minutes. The module does not have to be called
       in the account phase because the login calls pam_setcred(3)
       correctly.

---

 情况三 sudo 文件权限被修改

情况描述：有可能某些操作将整个/use/bin/下的文件权限全修改了，这个比较危险，可能很多命令有权限校验导致执行失败。比如 /usr/bin/sudo 权限不对时，就会执行失败的

sudo su -
sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set

处理办法：将权限改回来，并找到操作人员告知风险

# 查看一台正常的 sudo 命令文件的权限
stat /usr/bin/sudo
# 注意 Access 这一行
Access: (4111/---s--x--x)  Uid: (    0/    root)   Gid: (    0/    root)
# 在异常的操作系统通过 root 用户修改权限
chmod 4111 /usr/bin/sudo

---

情况四 远程执行 sudo 执行失败

情况描述：有些是否我们需要通过 ssh 在远程的机器上面执行 sudo 的命令，由于配置文件可能不被允许

ssh username@hostip "sudo date"
    sudo: sorry, you must have a tty to run sudo

处理办法：

查到是如下文件的如下参数导致的，说是不建议这种操作，会显示密码。

more /etc/sudoers
# Disable "ssh hostname sudo ", because it will show the password in clear.
#         You have to run "ssh -t hostname sudo ".
#
Defaults    requiretty 

可以选择注释这一行或者按照指示加 -t 参数，建议是按建议来

man ssh
-t      Force pseudo-terminal allocation.  
    This can be used to execute arbitrary screen-based programs on a remote machine, 
    which can be very useful, e.g. when implementing menu services.  
    Multiple -t options force tty allocation, even if ssh has no local tty.

---

以上是几种常见的 sudo 提权相关的问题，记录下来希望有所帮助