sudoers

̾Á°

½ñ¼°

EBNF ¤Î´Êñ¤Ê¥¬¥¤¥É

 ¥·¥ó¥Ü¥ë ::= ÄêµÁ | Ê̤ÎÄêµÁ 1 | Ê̤ÎÄêµÁ 2 ...

?

Á°¤ËÃÖ¤«¤ì¤¿¥·¥ó¥Ü¥ë (¤Þ¤¿¤Ï¡¢¥·¥ó¥Ü¥ë¤Î¥°¥ë¡¼¥×) ¤¬ ¾Êά²Äǽ¤Ç¤¢¤ë¤³¤È¤ò°ÕÌ£¤¹¤ë¡£ ¤Ä¤Þ¤ê¡¢¥·¥ó¥Ü¥ë¤¬ 1 ¸ÄÅо줹¤ë¤«¡¢¤¢¤ë¤¤¤ÏÁ´Á³Åо줷¤Ê¤¤¤«¤Ç¤¢¤ë¡£

*

Á°¤ËÃÖ¤«¤ì¤¿¥·¥ó¥Ü¥ë (¤Þ¤¿¤Ï¡¢¥·¥ó¥Ü¥ë¤Î¥°¥ë¡¼¥×) ¤¬ 0 ¸Ä°Ê¾åÅоì¤Ç¤­¤ë¡£

+

Á°¤ËÃÖ¤«¤ì¤¿¥·¥ó¥Ü¥ë (¤Þ¤¿¤Ï¡¢¥·¥ó¥Ü¥ë¤Î¥°¥ë¡¼¥×) ¤¬ 1 ¸Ä°Ê¾åÅо줹¤ë¡£

³ç¸Ì¤ò»È¤¦¤È¥·¥ó¥Ü¥ë¤ò¥°¥ë¡¼¥×¤Ë¤Þ¤È¤á¤ë¤³¤È¤¬¤Ç¤­¤ë¡£ °Ê¹ß¤ÎÎã¤Ç¤Ï¡¢(¥·¥ó¥Ü¥ë̾¤Ç¤Ï¤Ê¤¤) ʸ»úÄ̤ê¤Îʸ»úÎó¤Ï ¥·¥ó¥°¥ë¥¯¥ª¡¼¥È ('') ¤ò»ÈÍѤ·¤ÆÌÀ¼¨¤¹¤ë¡£  

¥¨¥¤¥ê¥¢¥¹

 Alias ::= 'User_Alias' = User_Alias (':' User_Alias)* |
           'Runas_Alias' = Runas_Alias (':' Runas_Alias)* |
           'Host_Alias' = Host_Alias (':' Host_Alias)* |
           'Cmnd_Alias' = Cmnd_Alias (':' Cmnd_Alias)*

 User_Alias ::= NAME '=' User_List

 Runas_Alias ::= NAME '=' Runas_User_List

 Host_Alias ::= NAME '=' Host_List

 Cmnd_Alias ::= NAME '=' Cmnd_List

 NAME ::= [A-Z]([A-Z][0-9]_)*

 Alias_Type NAME = item1, item2, ...

 Alias_Type NAME = item1, item2, item3 : NAME = item4, item5

 User_List ::= User |
               User ',' User_List

 User ::= '!'* username |
          '!'* '#'uid |
          '!'* '%'group |
          '!'* '+'netgroup |
          '!'* User_Alias

 Runas_List ::= Runas_User |
                Runas_User ',' Runas_List

 Runas_User ::= '!'* username |
                '!'* '#'uid |
                '!'* '%'group |
                '!'* +netgroup |
                '!'* Runas_Alias

 Host_List ::= Host |
               Host ',' Host_List

 Host ::= '!'* hostname |
          '!'* ip_addr |
          '!'* network(/netmask)? |
          '!'* '+'netgroup |
          '!'* Host_Alias

 Cmnd_List ::= Cmnd |
               Cmnd ',' Cmnd_List

 commandname ::= filename |
                 filename args |
                 filename '""'

 Cmnd ::= '!'* commandname |
          '!'* directory |
          '!'* Cmnd_Alias

Cmnd ¤¬¥³¥Þ¥ó¥É¥é¥¤¥ó°ú¤­¿ô¤È´ØÏ¢¤Å¤±¤é¤ì¤Æ¤¤¤ë¾ì¹ç¡¢ Cmnd ¤ÎÃæ¤Î°ú¤­¿ô¤Ï¡¢ ¥æ¡¼¥¶¤¬¥³¥Þ¥ó¥É¥é¥¤¥ó¤Ç»ØÄꤷ¤¿°ú¤­¿ô¤È´°Á´¤Ë¥Þ¥Ã¥Á¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤ (¥ï¥¤¥ë¥É¥«¡¼¥É¤¬¤¢¤Ã¤¿¾ì¹ç¤Ï¡¢¤½¤ì¤È´°Á´¤Ë¥Þ¥Ã¥Á¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤)¡£ /`,', `:', `=', `\' ¤È¤¤¤¦Ê¸»ú¤ò ¥³¥Þ¥ó¥É¥é¥¤¥ó°ú¤­¿ô¤È¤·¤Æ»È¤¦¾ì¹ç¡¢ /`\' ¤Ç¥¨¥¹¥±¡¼¥×¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤ÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£  

¥Ç¥Õ¥©¥ë¥È

 Default_Type ::= 'Defaults' ||
                  'Defaults' ':' User ||
                  'Defaults' '@' Host

 Default_Entry ::= Default_Type Parameter_List

 Parameter ::= Parameter '=' Value ||
               '!'* Parameter ||

¥Õ¥é¥°:

long_otp_prompt

(S/Key ¤ä OPIE ¤Ê¤É¤Î) ¥ï¥ó¥¿¥¤¥à¥Ñ¥¹¥ï¡¼¥É¤ò»ÈÍѤ·¤Æ¤¤¤ë¾ì¹ç¤Ë¤³¤Î¥ª¥×¥·¥ç¥ó¤¬Í­¸ú¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤È¡¢ ¥í¡¼¥«¥ë¤Ê¥¦¥¤¥ó¥É¥¦¤ËÆþÎϤ·¤¿¥Ñ¥¹¥ï¡¼¥É¤ò ´Êñ¤Ë¥«¥Ã¥È¡õ¥Ú¡¼¥¹¥È¤Ç¤­¤ë¤è¤¦¤Ë¡¢2 ¹Ô¤Î¥×¥í¥ó¥×¥È¤¬»È¤ï¤ì¤ë¡£ ¤³¤ì¤ò¥Ç¥Õ¥©¥ë¥È¤Ë¤¹¤ë¤Î¤ÏÎɤ¯¤Ê¤¤¤¬¡¢ÊØÍø¤À¤È¸À¤¦¿Í¤â¤¤¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

ignore_dot

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢$PATH ¤Ë¤¢¤ë (¥«¥ì¥ó¥È¥Ç¥£¥ì¥¯¥È¥ê¤òɽ¤¹) `.' ¤È `' ¤¬Ìµ»ë¤µ¤ì¤ë¡£ $PATH ¤½¤Î¤â¤Î¤ÏÊѹ¹¤µ¤ì¤Ê¤¤¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

mail_always

¥æ¡¼¥¶¤¬ sudo ¤ò¼Â¹Ô¤¹¤ëÅ٤ˡ¢mailto ¥æ¡¼¥¶¤Ë¥á¡¼¥ë¤¬Á÷¤é¤ì¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

mail_no_user

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ sudo ¤òµ¯Æ°¤·¤¿¥æ¡¼¥¶¤¬ sudoers ¥Õ¥¡¥¤¥ë¤Ë¤Ê¤¤¾ì¹ç¡¢ mailto ¥æ¡¼¥¶¤Ë¥á¡¼¥ë¤¬Á÷¤é¤ì¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï on ¤Ç¤¢¤ë¡£

mail_no_host

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ sudo ¤òµ¯Æ°¤·¤¿¥æ¡¼¥¶¤¬ sudoers ¥Õ¥¡¥¤¥ë¤Ë¸ºß¤¹¤ë¤¬¡¢ ¸½ºß¤Î¥Û¥¹¥È¤Ç¥³¥Þ¥ó¥É¤ò¼Â¹Ô¤¹¤ë¤³¤È¤¬µö²Ä¤µ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¡¢ mailto ¥æ¡¼¥¶¤Ë¥á¡¼¥ë¤¬Á÷¤é¤ì¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

mail_no_perms

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ ¥æ¡¼¥¶¤¬ sudo ¤ò»È¤¦¤³¤È¤Ïµö²Ä¤µ¤ì¤Æ¤¤¤ë¤¬¡¢ ¼Â¹Ô¤·¤è¤¦¤È¤·¤¿¥³¥Þ¥ó¥É¤¬ sudoers ¥Õ¥¡¥¤¥ë¤Î¥¨¥ó¥È¥ê¤Ë¤Ê¤¤¾ì¹ç¡¢ mailto ¥æ¡¼¥¶¤Ë¥á¡¼¥ë¤¬Á÷¤é¤ì¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

tty_tickets

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ ¥æ¡¼¥¶¤Ï tty Ëè¤Ëǧ¾Ú¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£ Ä̾sudo ¤Ï¥Á¥±¥Ã¥È¥Ç¥£¥ì¥¯¥È¥ê¤ÎÃæ¤Ë¤¢¤ë ¼Â¹Ô¤·¤Æ¤¤¤ë¥æ¡¼¥¶¤ÈƱ¤¸Ì¾Á°¤Î¥Ç¥£¥ì¥¯¥È¥ê¤ò»È¤¦¡£ ¤³¤Î¥Õ¥é¥°¤¬ on ¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤È¡¢sudo ¤Ï ¥Á¥±¥Ã¥È¥Ç¥£¥ì¥¯¥È¥ê¤ÎÃæ¤Ë¤¢¤ë ¥æ¡¼¥¶¤¬¥í¥°¥¤¥ó¤·¤Æ¤¤¤ë tty ¤ËÂбþ¤·¤¿¥Õ¥¡¥¤¥ë̾¤ò»È¤¦¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

lecture

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ ½é¤á¤Æ sudo ¤ò¼Â¹Ô¤·¤¿¤È¤­¡¢¥æ¡¼¥¶¤Ïû¤¤¥ì¥¯¥Á¥ã¡¼¤ò¼õ¤±¼è¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï on ¤Ç¤¢¤ë¡£

authenticate

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ ¥æ¡¼¥¶¤Ï¥Ñ¥¹¥ï¡¼¥É (¤â¤·¤¯¤Ï¡¢Ê̤Îǧ¾ÚÊýË¡) ¤Ç¼«Ê¬¼«¿È¤ËÂФ·¤Æ ǧ¾Ú¤ò¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£ ¤³¤Î¥Ç¥Õ¥©¥ë¥È¤ÎÃÍ¤Ï PASSWD ¥¿¥°¤È NOPASSWD ¥¿¥°¤ò»È¤Ã¤ÆÊѹ¹¤Ç¤­¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï on ¤Ç¤¢¤ë¡£

root_sudo

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢root ¤â sudo ¤¬¼Â¹Ô¤Ç¤­¤ë¡£ ¤³¤Î¥Õ¥é¥°¤ò off ¤Ë¤¹¤ë¤È¡¢¥æ¡¼¥¶¤¬ "sudo sudo /bin/sh" ¤Î¤è¤¦¤Ë¤·¤Æ root ¤Î¥·¥§¥ë¤òÆþ¼ê¤·¤è¤¦¤È ``Ä©À魯¤ë'' ¤³¤È¤¬ËɻߤǤ­¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï on ¤Ç¤¢¤ë¡£

log_host

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ ¥Û¥¹¥È̾¤¬ (syslog ¤Ç¤Ï¤Ê¤¤) sudo ¥í¥°¥Õ¥¡¥¤¥ë¤Ëµ­Ï¿¤µ¤ì¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

log_year

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ 4 ·å¤Îǯ¤¬ (syslog ¤Ç¤Ï¤Ê¤¤) sudo ¥í¥°¥Õ¥¡¥¤¥ë¤Ëµ­Ï¿¤µ¤ì¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

shell_noargs

¤³¤Î¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ë sudo ¤¬°ú¤­¿ô¤Ê¤·¤Çµ¯Æ°¤µ¤ì¤ë¤È¡¢ -s ¥Õ¥é¥°¤¬Í¿¤¨¤é¤ì¤¿¾ì¹ç¤ÈƱÍͤËÆ°ºî¤¹¤ë¡£ ¤Ä¤Þ¤ê¡¢sudo ¤Ï¥·¥§¥ë¤ò root ¤È¤·¤Æ¼Â¹Ô¤¹¤ë (´Ä¶­ÊÑ¿ô SHELL ¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¾ì¹ç¡¢ ¥·¥§¥ë¤Ï¤½¤Î´Ä¶­ÊÑ¿ô¤Ç·èÄꤵ¤ì¤ë¡£ ÀßÄꤵ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¡¢ µ¯Æ°¤·¤¿¥æ¡¼¥¶¤Î /etc/passwd ¤Î¥¨¥ó¥È¥ê¤Ë¤¢¤ë¥·¥§¥ë¤ò»È¤¦)¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

set_home

¤³¤Î¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ë sudo ¤¬ -s ¥Õ¥é¥°¤Çµ¯Æ°¤µ¤ì¤ë¤È¡¢ ´Ä¶­ÊÑ¿ô HOME ¤¬Âоݥ桼¥¶¤Î¥Û¡¼¥à¥Ç¥£¥ì¥¯¥È¥ê¤ËÀßÄꤵ¤ì¤ë (¤³¤Î¾ì¹ç¤ÎÂоݥ桼¥¶¤Ï¡¢-u ¥ª¥×¥·¥ç¥ó¤Ç»ØÄꤵ¤ì¤Ê¤¤¸Â¤ê root ¤Ç¤¢¤ë)¡£ ¤³¤Î¥Õ¥é¥°¤Ï¡¢-s ¥Õ¥é¥°¤¬»È¤ï¤ì¤¿¾ì¹ç¤Ë -H ¤ò°ÅÌۤΤ¦¤Á¤ËÍ­¸ú¤Ë¤¹¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

path_info

Ä̾ï sudo ¤Ï¥³¥Þ¥ó¥É¤¬ $PATH ¤Ë¸«¤Ä¤«¤é¤Ê¤¤¾ì¹ç¥æ¡¼¥¶¤Ë¹ðÃΤ¹¤ë¡£ Ä̾ï¤Î¥æ¡¼¥¶¤¬¡¢¥¢¥¯¥»¥¹¤Ç¤­¤Ê¤¤¼Â¹Ô¥Õ¥¡¥¤¥ë¤Î¾ì½ê¤Ë´Ø¤¹¤ë ¾ðÊó¤ò¼ý½¸¤Ç¤­¤Ê¤¤¤è¤¦¤Ë¡¢ ¥µ¥¤¥È¤Ë¤è¤Ã¤Æ¤Ï¤³¤Î¹ðÃΤò¥æ¡¼¥¶¤Ë¹Ô¤ï¤Ê¤¤¤è¤¦¤Ë¤·¤¿¤¤¤³¤È¤¬¤¢¤ë¤«¤â¤·¤ì¤Ê¤¤¡£ ¤·¤«¤·¹ðÃΤò¹Ô¤ï¤Ê¤¤¤È¡¢ ñ¤Ë¼Â¹Ô¥Õ¥¡¥¤¥ë¤¬¥æ¡¼¥¶¤Î $PATH ¤Ë¤Ê¤¤¤À¤±¤Î¾ì¹ç¤Ç¤â¡¢ sudo ¤Ï¥æ¡¼¥¶¤Ë¡Ö¼Â¹Ôµö²Ä¤¬¤Ê¤¤¡×¤ÈÅÁ¤¨¤Æ¤·¤Þ¤¤¡¢ ʶ¤é¤ï¤·¤¯¤Ê¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

fqdn

sudoers ¥Õ¥¡¥¤¥ë¤Ë´°Á´¤Ê¥É¥á¥¤¥ó̾ÉÕ¤­¤Î¥Û¥¹¥È̾¤òÆþ¤ì¤¿¤¤¾ì¹ç¤Ï¡¢ ¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¡£ ¤¹¤Ê¤ï¤Á myhost ¤Ç¤Ï¤Ê¤¯ myhost.mydomain.edu ¤ò»È¤¤¤¿¤¤¾ì¹ç¤Ç¤¢¤ë¡£ ¤³¤Î¥Õ¥é¥°¤òÀßÄꤷ¤Æ¤â¡¢»È¤¤¤¿¤±¤ì¤Ðû¤¤·Á¼°¤ò»È¤¦¤³¤È¤¬¤Ç¤­¤ë (û¤¤·Á¼°¤È´°Á´¤Ê·Á¼°¤òº®¤¼¤Æ»È¤¦¤³¤È¤â¤Ç¤­¤ë)¡£ fqdn ¤ò on ¤Ë¤¹¤ë¤È¡¢sudo ¤Ï DNS ¤Î¥ë¥Ã¥¯¥¢¥Ã¥×¤¬É¬Íפˤʤ뤳¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£ DNS ¤Î¥ë¥Ã¥¯¥¢¥Ã¥×¤ò¤¹¤ë¤È¡¢ DNS ¤¬²ÔƯ¤·¤Æ¤¤¤Ê¤¤¤È¤­ (·×»»µ¡¤¬¥Í¥Ã¥È¥ï¡¼¥¯¤ËÀܳ¤µ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¤Ê¤É) sudo ¤Ï°ÂÁ´¤Ç¤Ê¤¯¤Ê¤ë¡£ DNS ¤Ë¤¢¤ë¥Û¥¹¥È¤ÎÀµ¼°¤Ê̾Á°¤ò»È¤ï¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤ÅÀ¤Ë¤âÃí°Õ¤¹¤ë¤³¤È¡£ ¤Ä¤Þ¤ê¡¢¥Ñ¥Õ¥©¡¼¥Þ¥ó¥¹¤ÎÌäÂê¤È DNS ¤«¤éÁ´¤Æ¤Î¥¨¥¤¥ê¥¢¥¹¤ò¼èÆÀ¤Ç¤­¤Ê¤¤¤È¤¤¤¦ÌäÂ꤫¤é¡¢ ¥Û¥¹¥È̾¤Î¥¨¥¤¥ê¥¢¥¹ (CNAME ¥¨¥ó¥È¥ê) ¤ò»È¤¦¤³¤È¤Ï¤Ç¤­¤Ê¤¤¡£ (hostname ¥³¥Þ¥ó¥É¤ÇÊÖ¤µ¤ì¤ë) ·×»»µ¡¤Î¥Û¥¹¥È̾¤¬ ´û¤Ë¥É¥á¥¤¥ó̾ÉÕ¤­¤Î´°Á´¤Ê¤â¤Î¤Ç¤¢¤ë¾ì¹ç¡¢ fqdn ¤òÀßÄꤹ¤ë¤Ù¤­¤Ç¤Ï¤Ê¤¤¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

insults

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢sudo ¤Ï ÉÔÀµ¤Ê¥Ñ¥¹¥ï¡¼¥É¤òÆþÎϤ·¤¿¥æ¡¼¥¶¤òÉî¿«¤¹¤ë¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

requiretty

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢ ¥æ¡¼¥¶¤¬ real tty ¤«¤é¥í¥°¥¤¥ó¤·¤Æ¤¤¤ë¤È¤­¤Î¤ß sudo ¤¬¼Â¹Ô¤Ç¤­¤ë¡£ rsh(1) ¤Ï tty ¤ò³ÎÊݤ·¤Ê¤¤¤Î¤Ç¡¢ "rsh somehost sudo ls" ¤È¤¤¤Ã¤¿¤³¤È¤¬µö²Ä¤µ¤ì¤Ê¤¯¤Ê¤ë¡£ tty ¤¬¤Ê¤¤¤È¥¨¥³¡¼¤¬¾Ã¤»¤Ê¤¤¤Î¤Ç¡¢ ÆþÎÏ»þ¤Ë¥Ñ¥¹¥ï¡¼¥É¤¬¸½¤ì¤Æ¤·¤Þ¤¦¤Î¤òËɻߤ¹¤ë¤¿¤á¤Ë¡¢ ¤³¤Î¥Õ¥é¥°¤òÀßÄꤷ¤¿¤¤¤È»×¤¦¥µ¥¤¥È¤â¤¢¤ë¤À¤í¤¦¡£ ¤³¤Î¥Õ¥é¥°¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï off ¤Ç¤¢¤ë¡£

env_editor

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢visudo ¤Ï ¥Ç¥Õ¥©¥ë¥È¤Î¥¨¥Ç¥£¥¿¤È¤·¤Æ´Ä¶­ÊÑ¿ô EDITOR ¤È VISUAL ¤ÎÃͤò»È¤¦¡£ ÂçÉôʬ¤Î¥¨¥Ç¥£¥¿¤Ç¤Ï¥æ¡¼¥¶¤¬¥·¥§¥ë (root ¤Î¥·¥§¥ë¤Î¾ì¹ç¤â¤¢¤ê¡¢¥í¥°¤Ëµ­Ï¿¤µ¤ì¤Ê¤¤) ¤ò¼èÆÀ¤Ç¤­¤Æ¤·¤Þ¤¦¤Î¤Ç¡¢ ¤³¤ì¤Ï¥»¥­¥å¥ê¥Æ¥£¥Û¡¼¥ë¤òºî¤Ã¤Æ¤·¤Þ¤¦¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£

rootpw

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢sudo ¤Ï µ¯Æ°¤·¤¿¥æ¡¼¥¶¤Î¥Ñ¥¹¥ï¡¼¥É¤Ç¤Ï¤Ê¤¯¡¢ root ¤Î¥Ñ¥¹¥ï¡¼¥É¤òÍ׵᤹¤ë¡£

runaspw

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢sudo ¤Ï µ¯Æ°¤·¤¿¥æ¡¼¥¶¤Î¥Ñ¥¹¥ï¡¼¥É¤Ç¤Ï¤Ê¤¯¡¢ runas_default ¥ª¥×¥·¥ç¥ó¤ÇÄêµÁ¤µ¤ì¤¿¥æ¡¼¥¶ (¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï root) ¤Î¥Ñ¥¹¥ï¡¼¥É¤òÍ׵᤹¤ë¡£

targetpw

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢sudo ¤Ï µ¯Æ°¤·¤¿¥æ¡¼¥¶¤Î¥Ñ¥¹¥ï¡¼¥É¤Ç¤Ï¤Ê¤¯¡¢ -u ¥Õ¥é¥°¤Ç»ØÄꤵ¤ì¤¿¥æ¡¼¥¶ (¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï root) ¤Î¥Ñ¥¹¥ï¡¼¥É¤òÍ׵᤹¤ë¡£

set_logname

Ä̾ï sudo ¤Ï´Ä¶­ÊÑ¿ô LOGNAME ¤È USER ¤òÂоݥ桼¥¶ (-u ¥Õ¥é¥°¤Ç»ØÄꤵ¤ì¤Ê¤¤¤±¤ì¤Ð¤Õ¤Ä¤¦¤Ï root) ¤Î̾Á°¤ËÀßÄꤹ¤ë¡£ ¤·¤«¤·¡¢¼ÂºÝ¤Î¥æ¡¼¥¶¤Î¼±ÊÌ¤Ë LOGNAME ¤ò»È¤¦¥×¥í¥°¥é¥à (RCS revision control system ¤Ê¤É¤¬´Þ¤Þ¤ì¤ë) ¤¬¤¢¤ë¤Î¤Ç¡¢ ¤³¤ÎµóÆ°¤òÊѹ¹¤·¤¿¤¤¤³¤È¤â¤¢¤ë¡£ ¤³¤ì¤Ë¤Ï set_logname ¤ò off ¤Ë¤¹¤ì¤Ð¤è¤¤¡£

use_loginclass

¤³¤Î¥Õ¥é¥°¤òÀßÄꤹ¤ë¤È¡¢sudo ¤Ï¡¢ Âоݥ桼¥¶¤Î¥í¥°¥¤¥ó¥¯¥é¥¹¤¬¤¢¤ì¤Ð¡¢¤½¤ì¤Ë»ØÄꤵ¤ì¤¿¥Ç¥Õ¥©¥ë¥È¤ÎÃͤòŬÍѤ¹¤ë¡£ sudo ¤Î (¥³¥ó¥Ñ¥¤¥ë»þ¤Ë) --with-logincap ¥ª¥×¥·¥ç¥ó¤¬ ÀßÄꤵ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ë¤Î¤ß¡¢Í­¸ú¤Ç¤¢¤ë¡£

À°¿ô:

passwd_tries

sudo ¤¬¼ºÇÔ¤ò¥í¥°¤Ëµ­Ï¿¤·¤Æ½ªÎ»¤¹¤ë¤Þ¤Ç¤Ë¡¢ ¥æ¡¼¥¶¤¬¥Ñ¥¹¥ï¡¼¥É¤òÆþÎϤǤ­¤ë²ó¿ô¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï 3¡£

¿¿µ¶ÃͤȤ·¤Æ¤â»ÈÍѤµ¤ì¤ëÀ°¿ô:

loglinelen

¥Õ¥¡¥¤¥ë¥í¥°¤Î 1 ¹ÔÅö¤¿¤ê¤Îʸ»ú¿ô¡£ ¤³¤ÎÃͤϡ¢¥í¥°¥Õ¥¡¥¤¥ë¤ò¸«¤ä¤¹¤¯¤¹¤ë¤¿¤á¤Ë¡¢ ¹Ô¤ò²¿·å¤ÇÀÞ¤êÊÖ¤¹¤«¤ò·èÄꤹ¤ë¤¿¤á¤Ë»È¤ï¤ì¤ë¡£ syslog ¥Õ¥¡¥¤¥ë¤Ë¤Ï²¿¤â±Æ¶Á¤»¤º¡¢¥Õ¥¡¥¤¥ë¥í¥°¤À¤±¤Ë±Æ¶Á¤¹¤ë¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï 80 (ÀÞ¤êÊÖ¤·¤ò¤·¤Ê¤¤¾ì¹ç¤Ï 0 ¤ò»ØÄꤹ¤ë)¡£

timestamp_timeout

sudo ¤¬ºÆÅ٥ѥ¹¥ï¡¼¥É¤ò¿Ò¤Í¤ë¤Þ¤Ç¤Ë·Ð²á¤¹¤ëʬ¿ô¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï 5¡£ ¾ï¤Ë¥Ñ¥¹¥ï¡¼¥É¤òÍ׵ᤵ¤»¤ë¤Ë¤Ï 0 ¤ËÀßÄꤹ¤ë¡£

passwd_timeout

sudo ¤Î¥Ñ¥¹¥ï¡¼¥ÉÍ׵᤬»þ´ÖÀÚ¤ì¤Ë¤Ê¤ë¤Þ¤Ç¤Îʬ¿ô¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï 5¡£ ¥Ñ¥¹¥ï¡¼¥ÉÍ×µá¤Î»þ´ÖÀÚ¤ì¤ò¤Ê¤¯¤¹¤Ë¤Ï 0 ¤ËÀßÄꤹ¤ë¡£

umask

root ¥³¥Þ¥ó¥É¤ò¼Â¹Ô¤¹¤ë¾ì¹ç¤Î umask¡£ ¥æ¡¼¥¶¤Î umask ¤ò¾å½ñ¤­¤·¤Ê¤¤¤¿¤á¤Ë¤Ï¡¢0777 ¤ËÀßÄꤹ¤ë¤³¤È¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï 0022¡£

ʸ»úÎó:

mailsub

mailto ¥æ¡¼¥¶¤ËÁ÷¤é¤ì¤ë¥á¡¼¥ë¤Î Subject (Âê̾)¡£ ¥¨¥¹¥±¡¼¥× %h ¤Ï·×»»µ¡¤Î¥Û¥¹¥È̾¤ËŸ³«¤µ¤ì¤ë¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï ``*** SECURITY information for %h ***''¡£

badpass_message

¥æ¡¼¥¶¤¬ÉÔÀµ¤Ê¥Ñ¥¹¥ï¡¼¥É¤òÆþÎϤ·¤¿¾ì¹ç¤Ëɽ¼¨¤µ¤ì¤ë¥á¥Ã¥»¡¼¥¸¡£ insults ¤¬ÀßÄꤵ¤ì¤Æ¤¤¤Ê¤¤¸Â¤ê¡¢ ¥Ç¥Õ¥©¥ë¥È¤Ï ``Sorry, try again.''¡£

timestampdir

sudo ¤¬¥¿¥¤¥à¥¹¥¿¥ó¥×¥Õ¥¡¥¤¥ë¤òÃÖ¤¯¥Ç¥£¥ì¥¯¥È¥ê¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï @TIMEDIR@¡£

passprompt

¥Ñ¥¹¥ï¡¼¥É¤ò¿Ò¤Í¤ë¤È¤­¤Ë»È¤ï¤ì¤ë¥Ç¥Õ¥©¥ë¥È¤Î¥×¥í¥ó¥×¥È¡£ -p ¥ª¥×¥·¥ç¥ó¤ä´Ä¶­ÊÑ¿ô SUDO_PROMPT ¤ò»È¤Ã¤ÆÊѹ¹¤Ç¤­¤ë¡£ 2 ¤Ä¤Î¥¨¥¹¥±¡¼¥×¤¬¥µ¥Ý¡¼¥È¤µ¤ì¤Æ¤¤¤ë¡£ ``%u'' ¤Ï¥æ¡¼¥¶¤Î¥í¥°¥¤¥ó̾¤ËŸ³«¤µ¤ì¡¢ ``%h'' ¤Ï¥í¡¼¥«¥ë¥Û¥¹¥È̾¤ËŸ³«¤µ¤ì¤ë¡£ ¥Ç¥Õ¥©¥ë¥È¤ÎÃÍ¤Ï ``Password:''¡£

runas_default

-u ¥Õ¥é¥°¤¬¥³¥Þ¥ó¥É¥é¥¤¥ó¤Ç»ØÄꤵ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¤Ë¡¢ ¥³¥Þ¥ó¥É¤ò¼Â¹Ô¤¹¤ë¥Ç¥Õ¥©¥ë¥È¤Î¥æ¡¼¥¶¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï ``root''¡£

syslog_goodpri

¥æ¡¼¥¶¤¬Ç§¾Ú¤ËÀ®¸ù¤·¤¿¾ì¹ç¤Ë»È¤ï¤ì¤ë syslog ¤Î priority¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï ``notice''¡£

syslog_badpri

¥æ¡¼¥¶¤¬Ç§¾Ú¤Ë¼ºÇÔ¤·¤¿¾ì¹ç¤Ë»È¤ï¤ì¤ë syslog ¤Î priority¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï ``alert''¡£

editor

visudo ¤¬»ÈÍѤ¹¤ë¥¨¥Ç¥£¥¿¤Î¥Ñ¥¹¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï¥·¥¹¥Æ¥à¾å¤Î vi ¤Î¥Ñ¥¹¡£

¿¿µ¶ÃͤȤ·¤Æ¤â»ÈÍѤµ¤ì¤ëʸ»úÎó:

logfile

(syslog ¥í¥°¥Õ¥¡¥¤¥ë¤Ç¤Ï¤Ê¤¯) sudo ¥í¥°¥Õ¥¡¥¤¥ë¤Ø¤Î¥Ñ¥¹¡£ ¥Ñ¥¹¤òÀßÄꤹ¤ë¤È¡¢¤½¤Î¥Õ¥¡¥¤¥ë¤Ø¥í¥°¤¬µ­Ï¿¤µ¤ì¤ë¡£ ÀßÄꤷ¤Ê¤±¤ì¤Ð¡¢µ­Ï¿¤µ¤ì¤Ê¤¤¡£

syslog

¥í¥°¤Îµ­Ï¿¤Ë syslog ¤¬»È¤ï¤ì¤Æ¤¤¤ë¾ì¹ç¤Î syslog ¤Î facility (syslog ¤Ë¤è¤ë¥í¥°¤Îµ­Ï¿¤ò¤·¤Ê¤¤¾ì¹ç¤Ï¡¢ÀßÄꤷ¤Ê¤¤¤³¤È)¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï ``local2''¡£

mailerpath

·Ù¹ð¥á¡¼¥ë¤òÁ÷¤ë¤Î¤Ë»È¤ï¤ì¤ë¥á¡¼¥ë¥×¥í¥°¥é¥à¤Î¥Ñ¥¹¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï¡¢ÀßÄê»þ¤Ë¸«¤Ä¤«¤Ã¤¿ sendmail ¤Î¥Ñ¥¹¡£

mailerflags

¥á¡¼¥é¡¼¤òµ¯Æ°¤¹¤ë¤È¤­¤Ë»È¤ï¤ì¤ë¥Õ¥é¥°¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï -t¡£

mailto

·Ù¹ð¥á¡¼¥ë¤È¥¨¥é¡¼¥á¡¼¥ë¤òÁ÷¤ë¥¢¥É¥ì¥¹¡£ ¥Ç¥Õ¥©¥ë¥È¤Ï ``root''¡£

exempt_group

¤³¤Î¥°¥ë¡¼¥×¤Ë°¤¹¤ë¥æ¡¼¥¶¤Ï¡¢¥Ñ¥¹¥ï¡¼¥É¤È PATH ¤¬É¬Íפʤ¤¡£ ¥Ç¥Õ¥©¥ë¥È¤Ç¤ÏÀßÄꤵ¤ì¤Æ¤¤¤Ê¤¤¡£

secure_path

sudo ¤Ç¼Â¹Ô¤µ¤ì¤ëÁ´¤Æ¤Î¥³¥Þ¥ó¥É¤Ë»È¤ï¤ì¤ë¥Ñ¥¹¡£ sudo ¤ò¼Â¹Ô¤¹¤ë¥æ¡¼¥¶¤ò¿®ÍѤ·¤Æ¤¤¤Ê¤¤¾ì¹ç¡¢ »ÈÍѤµ¤»¤¿¤¤Àµ¤·¤¤´Ä¶­ÊÑ¿ô PATH ¤ò»ØÄꤹ¤ë¡£ Ê̤λÈÍÑË¡¤È¤·¤Æ¤Ï¡¢``root ¤Î¥Ñ¥¹'' ¤ò ``¥æ¡¼¥¶¤Î¥Ñ¥¹'' ¤È ʬ¤±¤ë¤¿¤á¤Ë»È¤¦¾ì¹ç¤¬¤¢¤ë¡£ ¥Ç¥Õ¥©¥ë¥È¤Ç¤ÏÀßÄꤵ¤ì¤Æ¤¤¤Ê¤¤¡£

verifypw

¤³¤Î¥ª¥×¥·¥ç¥ó¤Ï¡¢¥æ¡¼¥¶¤¬ sudo ¤ò -v ¥ª¥×¥·¥ç¥ó¤Ç¼Â¹Ô¤·¤¿¤È¤­¤Ë¡¢ ¤¤¤Ä¥Ñ¥¹¥ï¡¼¥É¤¬É¬ÍפȤµ¤ì¤ë¤«¤òÀ©¸æ¤¹¤ë¡£ ¤³¤Î¥ª¥×¥·¥ç¥ó¤Ë¤Ï°Ê²¼¤ÎÃͤΤ¤¤º¤ì¤«¤òÀßÄê¤Ç¤­¤ë¡£

    all         ¥Ñ¥¹¥ï¡¼¥É¤ÎÆþÎϤò¤Ê¤·¤Ç¤¹¤Þ¤»¤ë¤¿¤á¤Ë¤Ï¡¢
                ¸½ºß¤Î¥Û¥¹¥È¤Î¤¹¤Ù¤Æ¤Î¥æ¡¼¥¶¤Î I<sudoers>
                ¥¨¥ó¥È¥ê¤Ë C<NOPASSWD> ¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ
                ¤¤¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£

    any         ¥Ñ¥¹¥ï¡¼¥É¤ÎÆþÎϤò¤Ê¤·¤Ç¤¹¤Þ¤»¤ë¤¿¤á¤Ë¤Ï¡¢
                ¸½ºß¤Î¥Û¥¹¥È¤Î¾¯¤Ê¤¯¤È¤â°ì¿Í¤Î¥æ¡¼¥¶¤Î
                I<sudoers> ¥¨¥ó¥È¥ê¤Ë C<NOPASSWD> ¥Õ¥é¥°¤¬
                ÀßÄꤵ¤ì¤Æ¤¤¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£

    never       ¥æ¡¼¥¶¤Ï¡¢B<-v> ¥Õ¥é¥°¤ò»È¤¦ºÝ¤Ë
                ¥Ñ¥¹¥ï¡¼¥É¤òɬÍפȤ·¤Ê¤¤¡£

    always      ¥æ¡¼¥¶¤Ï¡¢B<-v> ¥Õ¥é¥°¤ò»È¤¦ºÝ¤Ë
                ¾ï¤Ë¥Ñ¥¹¥ï¡¼¥É¤òÆþÎϤ¹¤ëɬÍפ¬¤¢¤ë¡£

¥Ç¥Õ¥©¥ë¥È¤ÎÃÍ¤Ï `all' ¤Ç¤¢¤ë¡£

listpw

¤³¤Î¥ª¥×¥·¥ç¥ó¤Ï¡¢¥æ¡¼¥¶¤¬ sudo ¤ò -l ¥ª¥×¥·¥ç¥ó¤Ç¼Â¹Ô¤·¤¿¤È¤­¤Ë¡¢ ¤¤¤Ä¥Ñ¥¹¥ï¡¼¥É¤¬É¬ÍפȤµ¤ì¤ë¤«¤òÀ©¸æ¤¹¤ë¡£ ¤³¤Î¥ª¥×¥·¥ç¥ó¤Ë¤Ï°Ê²¼¤ÎÃͤΤ¤¤º¤ì¤«¤òÀßÄê¤Ç¤­¤ë¡£

    all         ¥Ñ¥¹¥ï¡¼¥É¤ÎÆþÎϤò¤Ê¤·¤Ç¤¹¤Þ¤»¤ë¤¿¤á¤Ë¤Ï¡¢
                ¸½ºß¤Î¥Û¥¹¥È¤Î¤¹¤Ù¤Æ¤Î¥æ¡¼¥¶¤Î I<sudoers>
                ¥¨¥ó¥È¥ê¤Ë C<NOPASSWD> ¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ
                ¤¤¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£

    any         ¥Ñ¥¹¥ï¡¼¥É¤ÎÆþÎϤò¤Ê¤·¤Ç¤¹¤Þ¤»¤ë¤¿¤á¤Ë¤Ï¡¢
                ¸½ºß¤Î¥Û¥¹¥È¤Î¾¯¤Ê¤¯¤È¤â°ì¿Í¤Î¥æ¡¼¥¶¤Î
                I<sudoers> ¥¨¥ó¥È¥ê¤Ë C<NOPASSWD> ¥Õ¥é¥°¤¬
                ÀßÄꤵ¤ì¤Æ¤¤¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£

    never       ¥æ¡¼¥¶¤Ï¡¢B<-l> ¥Õ¥é¥°¤ò»È¤¦ºÝ¤Ë
                ¥Ñ¥¹¥ï¡¼¥É¤òɬÍפȤ·¤Ê¤¤¡£

    always      ¥æ¡¼¥¶¤Ï¡¢B<-l> ¥Õ¥é¥°¤ò»È¤¦ºÝ¤Ë
                ¾ï¤Ë¥Ñ¥¹¥ï¡¼¥É¤òÆþÎϤ¹¤ëɬÍפ¬¤¢¤ë¡£

¥Ç¥Õ¥©¥ë¥È¤ÎÃÍ¤Ï `any' ¤Ç¤¢¤ë¡£

syslog(3) ¤Ç¥í¥°¤òµ­Ï¿¤·¤Æ¤¤¤ë¾ì¹ç¡¢ sudo ¤Ï syslog ¤Î facility (syslog ¥Ñ¥é¥á¡¼¥¿¤ÎÃÍ) ¤È¤·¤Æ¡¢ authpriv (OS ¤¬¥µ¥Ý¡¼¥È¤·¤Æ¤¤¤ë¾ì¹ç), auth, daemon, user, local0, local1, local2, local3, local4, local5, local6, local7 ¤ò¼õ¤±ÉÕ¤±¤ë¡£ syslog ¤Î prioritiy ¤È¤·¤Æ¤Ï¡¢ alert, crit, debug, emerg, err, info, notice, warning ¤¬¥µ¥Ý¡¼¥È¤µ¤ì¤Æ¤¤¤ë¡£  

¥æ¡¼¥¶ÀßÄê

 User_Spec ::= User_list Host_List '=' User_List Cmnd_Spec_List \
               (':' User_Spec)*

 Cmnd_Spec_List ::= Cmnd_Spec |
                    Cmnd_Spec ',' Cmnd_Spec_List

 Cmnd_Spec ::= Runas_Spec? ('NOPASSWD:' | 'PASSWD:')? Cmnd

 Runas_Spec ::= '(' Runas_List ')'

¥æ¡¼¥¶ÀßÄê¤ò¹½À®Í×ÁǤ´¤È¤Ëʬ¤±¤Æ¤ß¤ë¡£  

Runas_Spec

 dgb    boulder = (operator) /bin/ls, /bin/kill, /usr/bin/who

    sudo -u operator /bin/ls.

 dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm

NOPASSWD ¤È PASSWD

 ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm

 ray    rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm

¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï¡¢¸½ºß¤Î¥Û¥¹¥È¾å¤Î¤¢¤ë¥æ¡¼¥¶¤Î¤É¤ì¤«¤Î¥¨¥ó¥È¥ê¤Ë NOPASSWD ¥¿¥°¤¬Å¬ÍѤµ¤ì¤Æ¤¤¤ì¤Ð¡¢ ¤½¤Î¥æ¡¼¥¶¤Ï sudo -l ¤ò¥Ñ¥¹¥ï¡¼¥É¤Ê¤·¤Ë¼Â¹Ô¤Ç¤­¤ë¤è¤¦¤Ë¤Ê¤ë¡£ ¤µ¤é¤Ë¡¢¤¢¤ë¥æ¡¼¥¶¤Î¸½ºß¤Î¥Û¥¹¥È¤Ë´ØÏ¢¤¹¤ëÁ´¤Æ¤Î¥¨¥ó¥È¥ê¤Ë NOPASSWD ¥¿¥°¤¬¤¢¤ë¾ì¹ç¤Ë¸Â¤ê¡¢ ¤½¤Î¥æ¡¼¥¶¤Ï sudo -v ¤ò¥Ñ¥¹¥ï¡¼¥É¤Ê¤·¤Ë¼Â¹Ô¤Ç¤­¤ë¤è¤¦¤Ë¤Ê¤ë¡£ ¤³¤ÎÆ°ºî¤Ï verifypw ¤È listpw ¥ª¥×¥·¥ç¥ó¤ò»È¤Ã¤ÆÊѹ¹¤Ç¤­¤ë¡£  

¥ï¥¤¥ë¥É¥«¡¼¥É (ÊÌ̾¡¢¥á¥¿¥­¥ã¥é¥¯¥¿):

*

Ǥ°Õ¤Î 0 ¸Ä°Ê¾å¤Îʸ»ú¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£

?

Ǥ°Õ¤Î 1 ¸Ä¤Îʸ»ú¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£

[...]

»ØÄꤷ¤¿ÈϰϤˤ¢¤ëǤ°Õ¤Îʸ»ú¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£

[!...]

»ØÄꤷ¤¿ÈϰϤˤʤ¤Ç¤°Õ¤Îʸ»ú¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£

\x

``x'' ¤Çɾ²Á¤µ¤ì¤ëǤ°Õ¤Îʸ»ú ``x''¡£ ¤³¤ì¤Ï¡¢``*'', ``?'', ``['', ``}'' ¤Î¤è¤¦¤Ê ¥¨¥¹¥±¡¼¥×ʸ»ú¤ËÂФ·¤Æ»È¤ï¤ì¤ë¡£

¥Õ¥©¥ï¡¼¥É¥¹¥é¥Ã¥·¥å ('/') ¤Ï¡¢¥Ñ¥¹Ì¾¤Ç»È¤ï¤ì¤ë¥ï¥¤¥ë¥É¥«¡¼¥É¤ËÂФ·¤Æ¤Ï ¥Þ¥Ã¥Á¤·¤Ê¤¤ÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£ ¥³¥Þ¥ó¥É¥é¥¤¥ó°ú¤­¿ô¤ËÂФ·¤Æ¥Þ¥Ã¥Á¥ó¥°¤ò¤¹¤ë¾ì¹ç¡¢ ¥¹¥é¥Ã¥·¥å¤Ï¥ï¥¤¥ë¥É¥«¡¼¥É¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£ ¤³¤ì¤Ï

    /usr/bin/*

¥ï¥¤¥ë¥É¥«¡¼¥É¤Îµ¬Â§¤Ë¤ª¤±¤ëÎã³°:

¶õ¤Îʸ»úÎó "" ¤¬ sudoers ¥¨¥ó¥È¥ê¤Î Í£°ì¤Î¥³¥Þ¥ó¥É¥é¥¤¥ó°ú¤­¿ô¤Ç¤¢¤ë¾ì¹ç¡¢ ¡Ö¥³¥Þ¥ó¥É¤Ë°ú¤­¿ô¤ò¤Ä¤±¤¿¤È¤­¤Ï¡¢¼Â¹Ô¤¹¤ë¤³¤È¤¬µö²Ä¤µ¤ì¤Ê¤¤¡× ¤È¤¤¤¦¤³¤È¤ò°ÕÌ£¤¹¤ë¡£

¤½¤Î¾¤ÎÆüìʸ»ú¤ÈͽÌó¸ì:

ͽÌó¸ì ALL ¤ÏÁȹþ¤ß¤Î¥¨¥¤¥ê¥¢¥¹¤Ç¡¢ ¾ï¤Ë¥Þ¥Ã¥Á¤òÀ®¸ù¤µ¤»¤ë¡£ ¤³¤ÎͽÌó¸ì¤Ï¤É¤³¤Ç¤â»È¤¨¤ë¡£ ¤³¤ì¤ò»È¤¤¤¿¤¯¤Ê¤¤¾ì¹ç¤Ï¡¢ Cmnd_Alias, User_Alias, Runas_Alias, Host_Alias ¤ò»È¤¦¤³¤È¡£ ALL ¤È¤¤¤¦ ¥¨¥¤¥ê¥¢¥¹ ¤ò¼«Ê¬¤ÇÄêµÁ¤·¤è¤¦¤È¤·¤Æ¤Ï¤Ê¤é¤Ê¤¤¡£ Áȹþ¤ß¤Î¥¨¥¤¥ê¥¢¥¹¤¬Í¥À褵¤ì¤ë¤«¤é¤Ç¤¢¤ë¡£ ALL ¤ò»È¤¦¤È´í¸±¤Ë¤Ê¤ë²ÄǽÀ­¤¬¤¢¤ëÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£ ¤Ê¤¼¤Ê¤é¡¢¤³¤ì¤ò¥³¥Þ¥ó¥É¤Î»ØÄê¤Ç»È¤¦¤È¡¢ ¥æ¡¼¥¶¤Ï¥·¥¹¥Æ¥à¾å¤ÎÁ´¤Æ¤Î¥³¥Þ¥ó¥É¤ò¼Â¹Ô¤Ç¤­¤ë¤«¤é¤Ç¤¢¤ë¡£

´¶Ã²Éä ('!') ¤Ï¡¢¥¨¥¤¥ê¥¢¥¹¤ÎÃæ¤È Cmnd ¤ÎÁ°¤Ç¡¢ ÏÀÍý³Ø¤Î not ¥ª¥Ú¥ì¡¼¥¿¤È¤·¤Æ»È¤¦¤³¤È¤¬¤Ç¤­¤ë¡£ ¤³¤ì¤Ë¤è¤ê¡¢¤¢¤ëÃͤòÇÓ½ü¤Ç¤­¤ë¡£ ¤·¤«¤· ! ¤òÁȹþ¤ß¤Î ALL ¥¨¥¤¥ê¥¢¥¹¤ÈÁȤ߹ç¤ï¤»¤Æ¡¢ ¥æ¡¼¥¶¤¬ ``Á´¤Æ¤Ç¤Ï¤Ê¤¯°ìÉô¤Î'' ¥³¥Þ¥ó¥É¤ò¼Â¹Ô¤Ç¤­¤ë¤è¤¦¤Ë ¤·¤è¤¦¤È¤·¤Æ¤â¡¢°Õ¿Þ¤·¤¿¤è¤¦¤ËÆ°ºî¤¹¤ë¤³¤È¤Ïµ©¤Ç¤¢¤ëÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È (°Ê²¼¤Î¡Ö¥»¥­¥å¥ê¥Æ¥£¾å¤ÎÃí°Õ¡×¤ò»²¾È)¡£

Ť¤¹Ô¤Ï¡¢¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å ('\') ¤ò¹Ô¤ÎºÇ¸å¤Îʸ»ú¤Ë¤¹¤ì¤Ð ³¤±¤ë¤³¤È¤¬¤Ç¤­¤ë¡£

¥ê¥¹¥È¤Ë¤ª¤±¤ë¹½À®Í×ÁǴ֤ζõÇò¤ä¡¢ ¥æ¡¼¥¶ÀßÄê¤Ë¤ª¤±¤ëÆüì¤Ê¹½Ê¸Ê¸»ú ('=', `:', `(', `)') ¤Ï¡¢¤Ê¤¯¤Æ¤â¤è¤¤¡£

'@', `!', `=', `:', `,', `(', `)', `\' ¤È¤¤¤¦Ê¸»ú¤ò¥ï¡¼¥É (Î㤨¤Ð¡¢¥æ¡¼¥¶Ì¾¤ä¥Û¥¹¥È̾) ¤Î°ìÉô¤È¤·¤Æ»È¤¦¾ì¹ç¤Ï¡¢ ¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å ('\') ¤Ç¥¨¥¹¥±¡¼¥×¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£  

Îã

 # User alias specification
 User_Alias     FULLTIMERS = millert, mikef, dowdy
 User_Alias     PARTTIMERS = bostley, jwfox, crawl
 User_Alias     WEBMASTERS = will, wendy, wim

 # Runas alias specification
 Runas_Alias    OP = root, operator
 Runas_Alias    DB = oracle, sybase

 # Host alias specification
 Host_Alias     SPARC = bigtime, eclipse, moet, anchor :\
                SGI = grolsch, dandelion, black :\
                ALPHA = widget, thalamus, foobar :\
                HPPA = boa, nag, python
 Host_Alias     CUNETS = 128.138.0.0/255.255.0.0
 Host_Alias     CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
 Host_Alias     SERVERS = master, mail, www, ns
 Host_Alias     CDROM = orion, perseus, hercules

 # Cmnd alias specification
 Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
                        /usr/sbin/restore, /usr/sbin/rrestore
 Cmnd_Alias     KILL = /usr/bin/kill
 Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm
 Cmnd_Alias     SHUTDOWN = /usr/sbin/shutdown
 Cmnd_Alias     HALT = /usr/sbin/halt, /usr/sbin/fasthalt
 Cmnd_Alias     REBOOT = /usr/sbin/reboot, /usr/sbin/fastboot
 Cmnd_Alias     SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
                         /usr/local/bin/tcsh, /usr/bin/rsh, \
                         /usr/local/bin/zsh
 Cmnd_Alias     SU = /usr/bin/su

 # Override builtin defaults
 Defaults               syslog=auth
 Defaults:FULLTIMERS    !lecture
 Defaults:millert       !authenticate
 Defaults@SERVERS       log_year, logfile=/var/log/sudo.log

 root           ALL = (ALL) ALL
 %wheel         ALL = (ALL) ALL

 FULLTIMERS     ALL = NOPASSWD: ALL

 PARTTIMERS     ALL = ALL

 jack           CSNETS = ALL

 lisa           CUNETS = ALL

 operator       ALL = DUMPS, KILL, PRINTING, SHUTDOWN, HALT, REBOOT,\
                /usr/oper/bin/

 joe            ALL = /usr/bin/su operator

 pete           HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root

 bob            SPARC = (OP) ALL : SGI = (OP) ALL

 jim            +biglab = ALL

 +secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser

 fred           ALL = (DB) NOPASSWD: ALL

 john           ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*

 jen            ALL, !SERVERS = ALL

 jill           SERVERS = /usr/bin/, !SU, !SHELLS

 steve          CSNETS = (operator) /usr/local/op_commands/

 matt           valkyrie = KILL

 WEBMASTERS     www = (www) ALL, (root) /usr/bin/su www