企业实战项目之服务器用户权限集中管理

1

2

3

4

5

6

7

8

9

10

11

1、目前公司有初级运维三人、高级运维二人、运维经理一人

2、项目经理三人

3、初级开发人员三人、高级开发二人、开发经理一人

4、高级网络工程师一人

5、高级DBA一人

6、目前权限管理存在无序的状态，服务器操作非常不安全

7、系统环境

[root@Centos ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Centos ~]# uname -r

2.6.32-431.el6.x86_64

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

yuw001

yuw002

yuw003

gyuw001

gyuw002

yuwmanager

manager  

cjkaifa001

cjkaifa002

cjkaifa003

gjkaifa001

gjkaifa001

kaifamanager 

gjnetwork001  

gjdba001

密码统一设置为111111

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

## Command Aliases For sudo by guanliyuan 20160808

Cmnd_Alias CY_CMD = /bin/ping, /bin/hostname, /usr/bin/free, /sbin/route, /bin/netstat

Cmnd_Alias GY_CMD =  /bin/ping, /bin/hostname, /usr/bin/free, /sbin/route, \

 /bin/netstat, /sbin/ifconfig, /sbin/dhclient, /usr/bin/net, /sbin/iptables,\

 /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool, /bin/mount,\

 /bin/unmount, /sbin/fidisk, /sbin/parted, /sbin/sfdisk, /bin/rpm, /bin/kill

Cmnd_Alias CK_CMD = /usr/bin/tail/app/log*, /bin/cat, /bin/ls

Cmnd_Alias GK_CMD = /sbin/service, /sbin/chkconfig, /usr/bin/tail/app/log*,\

 /bin/cat, /bin/ls

Cmnd_Alias GNET_CMD = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient,\

 /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig,\

 /sbin/mii-tool

Cmnd_Alias GDBA_CMD = ALL, /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

1

2

3

4

5

6

7

8

9

## Users_Aliases For sudo by guanliyuan 20160808

User_Alias CYADMINS = yuw001, yuw002, yuw003

User_Alias GYADMINS = gyuw001, gyuw002

User_Alias CKADMINS = cjkaifa001, cjkaifa002, cjkaifa003

User_Alias GKADMINS = gjkaifa001, gjkaifa002

User_Alias GNETWORK = gjnetwork001

User_Alias GJDBA = gjdba001

1

2

3

## Runas_Aliases For sudo by guanliyuan 20160808

Runas_Alias     OP = root

1

2

3

4

5

6

7

8

9

10

11

12

13

##Config For sudoers

CYADMINS     ALL=(OP)       CY_CMD

GYADMINS     ALL=(OP)       GY_CMD

CKADMINS     ALL=(OP)       CK_CMD

GKADMINS     ALL=(OP)       GK_CMD

GNETWORK     ALL=(OP)       GNET_CMD

GJDBA        ALL=(OP)       GDBA_CMD

yuwmanager   ALL=(ALL)      NOPASSWD:ALL

manager      ALL=(ALL)      ALL, /usr/bin/passwd [A-Za-z]*, !/usr/passwd root, !/usr/sbin/visudo, !/usr/bin/vi *sudoer*

kaifamanager ALL=(ALL)      ALL, /usr/bin/passwd [A-Za-z]*, !/usr/passwd root, !/usr/sbin/visudo, !/usr/bin/vi *sudoer*

Defaults  logfile=/var/log/sudo.log

1

生产服务器中配置之前记得备份原有的配置文件,防止出现错误时可以即时恢复原来的配置