Sudo

bonjour,
il me semble qu'il est preferable de nommer l'user et de lui attribuer ce qu'il a droit

t /etc/sudoers
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
## 
## This file must be edited with the 'visudo' command.

## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using 
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2

## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
## rather than USERALIAS
User_Alias ADMINS = xxx


## Command Aliases
## These are groups of related commands...

## Networking
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
Cmnd_Alias LOCATE = /usr/sbin/updatedb

## Storage
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 

## Processes
Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
Cmnd_Alias DRIVERS = /sbin/modprobe

# Defaults specification

#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
#         You have to run "ssh -t hostname sudo <cmd>".
#
Defaults    requiretty

Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

## Next comes the main part: which users can run what software on 
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## 	user	MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere 
root	ALL=(ALL) 	ALL

## Allows members of the 'sys' group to run networking, software, 
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
# %wheel	ALL=(ALL)	ALL
ADMINS    ALL=(ALL)       ALL
## Same thing without a password
# %wheel	ALL=(ALL)	NOPASSWD: ALL
ADMINS ALL=(ALL)  NOPASSWD: ALL
## Allows members of the users group to mount and unmount the 
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

voila un fichier sudoers bien detailler qu'il suffit d'adapter au besoin
a+

regarde dans le /etc/sudoers en effet, par contre je serais critique sur celui qui a était posté, enfin plutôt une question :
%wheel HOST=(ALL) ALL,!/bin/sh,!/bin/bash, !/usr/bin/sudo
en faite tu accepte tout non ? tu ne fais aucune restriction.

Edit : j'ai lu trop vite, oui, tu fais restriction sur sh, bash et sudo, enfin je suis beaucoup plus restrictif en fait je crois…

Bonjour,
Je n'ai pas très bien saisi ta requête mais si tu veux passer en root il faut que tu tapes dans ta console:

sudo su

ci-joint un exemple de mon fichier /etc/sudoers

ici j'autorise le groupe wheel sur la machine HOST a utiliser toutes les commandes ALL sauf /bin/sh, /bin/bash /usr/bin/sudo

%wheel HOST=(ALL) ALL,!/bin/sh,!/bin/bash, !/usr/bin/sudo

dans ton cas il suffit de mettre

user machine=(ALL) les commandes que tu veux autoriser

Salut!

Euh… Je prendrais le problème autrement : laisser la commande que tu veux accessible à cet utilisateur, sans passer par sudo