用户集中管理

使用/etc/sudoers里设置用户别名、命令别名来设置各个用户类型所需要的权限和命令来控制用户权限和所能使用的命令
主机别名
# Host_Alias FILESERVERS = fs1, fs2

用户别名
组别名

# User_Alias ADMINS = jsmith, mikem# User_alias AdminsGroup=%xbin

命令别名
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

配置
用户 主机=(主机) 命令
root ALL=(ALL) ALL

sudoers文件配置
[root@xbin-S ~]# grep -v "##" /etc/sudoers

# Host_Alias     FILESERVERS = fs1, fs2# Host_Alias     MAILSERVERS = smtp, smtp2# User_Alias ADMINS = jsmith, mikem# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig# Cmnd_Alias LOCATE = /usr/bin/updatedb# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall# Cmnd_Alias DRIVERS = /sbin/modprobe# Defaults specification## Refuse to run if unable to disable echo on the tty.#Defaults   !visiblepw## Preserving HOME has security implications since many programs# use it when searching for configuration files. Note that HOME# is already set when the the env_reset option is enabled, so# this option is only effective for configurations where either# env_reset is disabled or HOME is present in the env_keep list.#Defaults    always_set_homeDefaults    env_resetDefaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"## Adding HOME to env_keep may enable a user to run unrestricted# commands via sudo.## Defaults   env_keep += "HOME"Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/binroot    ALL=(ALL)   ALLxbin    ALL=(ALL)   ALL# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS# %wheel    ALL=(ALL)   ALL# %wheel    ALL=(ALL)   NOPASSWD: ALL# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom# %users  localhost=/sbin/shutdown -h now#includedir /etc/sudoers.dDefaults        logfile=/var/log/sudo.log

实战命令
批量建立用户

for user in chuji001 chuji002 chuji003 net001 senior001 manager001do     useradd $user    echo "111111" | passwd --stdin $userdonefor n in `seq 5`do     useradd -g phpers php00$n    echo "111111" | passwd --stdin php00$ndonefor user in kaifamanager001 seniorphpersdo    useradd $user    echo "111111" | passwd --stdin $userdonesudoers 配置文件Cmnd_Alias CY_CMD_1 = /usr/bin/free, /usr/bin/iostat ,/usr/bin/top, /bin/hostname, /sbin/ifconfig,/bin/netstat, /sbin/routeCmnd_Alias GY_CMD_1 = /usr/bin/free, /usr/bin/iostat ,/usr/bin/top, /bin/hostname, /sbin/ifconfig,/bin/netstat, /sbin/route, /sbin/iptables, /etc/init.d/network, /bin/nice, /bin/kill/, /usr/bin/kill,/usr/bin/killall, /bin/rpm, /usr/bin/up2data, /user/bin/yum, /sbin/fdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umountCmnd_Alias CK_CMD_1 = /usr/bin/tail /app/log*, /bin/grep /app/log*, /bin/cat, /bin/lsCmnd_Alias GK_CMD_1 = /sbin/service, /sbin/chkconfig, /bin/tail /app/log*, /bin/grep /app/log*, /bin/cat, /bin/ls, /bin/sh ~/scripts/deploy.shCmnd_Alias GW_CMD_1 = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool, /bin/cat /var/log/*User_Alias CHUJIADMINS = chuji001, chuji002, chuji003User_Alias GWNETADMINS = net001User_Alias CHUJI_KAIFA = %phpersRunas_Alias OP = rootsenior001   ALL=(OP)    GY_CMD_1manager001  ALL=(ALL)   NOPASSWD:ALLkaifamanager001 ALL=(ALL) ALL,  /usr/bin/passwd [A-Za-z]*,!/usr/bin/passwd root, !/usr/sbin/visudo, ~/usr/bin/vi *sudoer*seniorphpers    ALL=(OP)    GK_CMD_1CHUJIADMINS     ALL=(OP)    CY_CMD_1GWNETADMINS ALL=(OP)    GW_CMD_1CHUJI_KAIFA ALL=(OP)    CK_CMD_1

批量创建20个用户，并设置密码为用户后随机5位数
[root@xbin-S ~]# cat test5.sh

#!/bin/bashexport PTAH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/binfor n in `seq 20`do        useradd user$n        echo "user$n`echo user$n|md5sum | cut -c1-5`" | passwd --stdin user$n        echo "user$n:user$n`echo user$n|md5sum | cut -c1-5`" >> /tmp/user_passwd.txt        #echo "user$n`echo user$n|md5sum | cut -c1-5`"done