Indlela yokusebenzisa izinhlelo njengempande kusukela kusiqalisi ku-Linux

Informatec Digital » Linux » Indlela yokusebenzisa izinhlelo njengempande kusukela kusiqalisi ku-Linux

Ku-Windows, abantu abaningi bajwayele ukucindezela u-Shift+Enter noma u-Shift+left-click ukuze bavule uhlelo olunamalungelo aphezulu kusuka kumenyu yokuqala. Ku-Linux, lokhu akulula ngaso sonke isikhathi, ngoba ukuphepha kuncike kubasizi be-root, sudo, kanye ne-graphical , futhi indawo ngayinye yedeskithophu inamathuluzi ayo. Noma kunjalo, kunezindlela ezilula zokuqalisa izinhlelo zokusebenza njenge-root kusuka kusiqalisi, isinqamuleli, noma imenyu yezinhlelo zokusebenza, yize kubalulekile ukuqonda ukuthi ukwenza kanjalo kuhilelani.

Isihluthulelo ukuthi umsebenzisi we-root unokulawula okuphelele kwesistimu , futhi ukusatshalaliswa kwesimanje, ikakhulukazi i-Ubuntu kanye ne-derivatives yayo, kuvame ukukhubaza ukungena ngemvume okuqondile. Ngakho-ke, akuvamile ukungena ngemvume njenge-root, kodwa kunalokho kuphakamisa amalungelo ngezikhathi ezithile usebenzisa i-`sudo` noma uhlelo lwezithombe olucela iphasiwedi. Uma sifuna isithonjana sesiqalisi siqalise uhlelo lokusebenza olunalawo malungelo, kuzodingeka sishintshe umyalo esiwenzayo noma sidale isiqalisi esithile.

Kusho ukuthini ngempela ukusebenzisa into njengempande?

Ku-Linux, i-root yi-akhawunti ene- UID 0 kanye namalungelo angenamkhawulo . Ingafunda, iguqule, noma isuse noma yiliphi ifayela, ifake isofthiwe, ishintshe ukucushwa kwe-kernel, futhi ilawule izinqubo ezingezona ezanoma yimuphi umsebenzisi. Lokhu kuyenza ithuluzi elinamandla kakhulu, kodwa futhi kube yingozi enkulu uma isetshenziswa ngokunganaki. Ukuthayipha okulula okune-`rm` noma i-`mv` kungenza uhlelo lungasebenzi, futhi iskripthi esinonya esisetshenziswa njenge-root singafaka iminyango yangemuva, siguqule izindlela zokuphepha, noma sintshontshe idatha ngaphandle kokuthola umkhondo.

Ku-Ubuntu, i-akhawunti yempande ayinayo iphasiwedi ezenzakalelayo futhi ukungena ngemvume okuqondile akuvunyelwe. Ifilosofi iwukuthi usebenza ne-akhawunti yakho yomsebenzisi ejwayelekile futhi usebenzise i-`sudo` emisebenzini ethile . I-`sudo` empeleni isho ukusebenzisa umyalo njengomunye umsebenzisi, ngokuvamile i-root, ngemuva kokuqinisekisa ngephasiwedi yakho uma ungoweqembu le-`sudo`. Lokhu kunciphisa isikhathi odalulwa ngaso futhi kugcina irekhodi lokuthi ubani owenze ini.

Kodwa-ke, ezimweni ezithile kakhulu, njengokubuyisela uhlelo olulimele, ukusebenza ezindaweni ezivinjelwe, noma ukumisa izinsizakalo ezidinga ukufinyelela okuqhubekayo, ungase ucabangele ukunika amandla i-root okwesikhashana. Isincomo esijwayelekile ukuthi uyikhubaze futhi ngokushesha nje lapho kuvela isidingo. Uma uchitha isikhathi esincane njenge-root, kungcono ukuzinza nokuphepha komshini.

Izingozi zokusebenzisa impande ngaphandle kokuqapha

Enye yezingozi ezisobala kakhulu ukususwa ngengozi kwamafayela abalulekile . Njengempande, azikho imikhawulo yemvume; umyalo ofana no-`sudo rm -rf /` ungasula uhlelo ngaphandle kwesixwayiso. Ngokuvamile futhi akukho bin lokuphinda usebenzise lawa ma-deletion, ngakho-ke ukululama kungadinga amathuluzi ayinkimbinkimbi okuhlola noma ngisho nokufakwa kabusha kwesistimu okuphelele.

Enye ingozi ukusebenzisa izikripthi ezingathembekile. Uma usebenzisa ikhodi elandiwe kunoma yiliphi isayithi elinamalungelo aphezulu, empeleni uyinika okhiye bendlu yakho . Ngisho noma iskripthi sibonakala singenangozi, singaqukatha imiyalelo ebhubhisayo noma sifake i-malware enamalungelo ezimpande. Ngakho-ke, kuyalulekwa ukuthi ubuyekeze ikhodi, usebenzise imithombo esemthethweni, uhlole ama-checksum, bese uyihlola emshinini obonakalayo noma esitsheni ngaphambi kokuyisebenzisa ekukhiqizeni.

Kukhona futhi inkinga yokulandelela. Uma usebenzisa i-`sudo`, uhlelo lubhala umyalo, umsebenzisi owukhiphe, kanye nesikhathi sokuthi `/var/log/auth.log`, `/var/log/secure`, noma `journalctl` . Uma ungena ngqo njengempande, konke kubonakala njengempande, futhi ulahlekelwa ikhono lokwazi ukuthi yimuphi umuntu owenze ushintsho ngalunye. Ezindaweni ezinama-administrators amaningi noma i-ISO 27001, i-PCI DSS, noma ezinye izindinganiso zokuhlola, lokhu kuntuleka kokulandelela kuwubuthakathaka obukhulu.

Izindlela zokuthola amalungelo avela ku-terminal

Indlela evame kakhulu nenconywayo kakhulu iwukuba ngaphambi komyalo othize nge-`sudo`. Isibonelo, ukuze ubuyekeze amaphakheji, uqale kabusha isevisi, noma uhlele ifayela elivikelwe, i-`sudo` izocela iphasiwedi yakho yomsebenzisi, hhayi iphasiwedi engumsuka, futhi ngemva kokukuqinisekisa, izosebenzisa umyalo ngamalungelo aphezulu. Uma udinga ukuwusebenzisa njengomsebenzisi ohlukile, ungasebenzisa umyalo we-`sudo -u username` . Futhi uma ubona ukuthi ukhohliwe ukusebenzisa i-`sudo`, ungaphinda umyalo wokugcina nge -`sudo!! `.

Uma uzokwenza imisebenzi eminingana yokuphatha ilandelana, kungaba lula ukuvula igobolondo lempande lesikhashana. I-`sudo -i` ilingisa ukungena ngemvume okugcwele kwempande, ilayisha indawo yempande, futhi ikubeke kufolda yasekhaya. I-`sudo su` noma i-`sudo su -` nayo iyasebenza, yize i-`sudo -i` ivame ukuthembeka kakhulu. Ukuze uphume kulesi seshini, vele uthayiphe i-`exit`. Akunconywa ukushiya igobolondo lempande livuliwe linganakekelwe.

Ngakolunye uhlangothi, umyalo othi `su` ushintsha abasebenzisi. `su - impande` noma umane uthi `su -` futhi wamukela iziguquguquko zemvelo zomsebenzisi oqondiwe, kuyilapho u-`su impande` noma u-`su` ongenalo i-hyphen egcina ingxenye yendawo yangaphambilini. Lo mehluko uchaza amaphutha afana nokuthi `command not found`: imiyalo yokuphatha ivame ukutholakala ku-`/usr/local/sbin`, `/usr/sbin`, kanye no-`/sbin`, izindlela ezingaveli njalo ku-PATH yomsebenzisi ojwayelekile. Uma usebenzisa u-`su` ngaphandle kwe-hyphen, kuzodingeka uthayiphe indlela ephelele noma ushintshele ku-`su -` ukuze uthole i-PATH yempande.

Uma ufuna ukuvula iphasiwedi yempande, ungakwenza lokho nge -`sudo passwd root` . Ubuntu iyakuvimbela lokhu, kodwa ngobuchwepheshe ivumela izimpande ukuthi zibe nephasiwedi. Ukuze ukhiye i-akhawunti, sebenzisa i-`sudo passwd -l root` , futhi ukuze uyivule, sebenzisa i-`sudo passwd -u root`. Ku-SSH, ukufinyelela kwezimpande ngqo kulawulwa yi -`PermitRootLogin` ku-`/etc/ssh/sshd_config`. Kuphephile ukuyigcina isethwe ku-`cha` noma, okungenani, i-`prohibit-password` ukuze ivumele amaphasiwedi e-SSH kuphela. Ngemuva kwalokho, udinga ukuqala kabusha isevisi ye-SSH.

Lungiselela ama-sweaters ngokunembile

Ifayela elithi `/etc/sudoers` lichaza ukuthi ubani ongasebenzisa i-`sudo` futhi ngayiphi injongo. Kungcono ukungalihleli ngesandla; indlela efanele ukusebenzisa i -`sudo visudo` , ekhiya ifayela futhi ihlole i-syntax ngaphambi kokulondoloza. Umthetho oyisisekelo uthatha ifomu elithi `host user=(target_user)`. Isibonelo, i-`bob ALL=(ALL) ALL` ivumela i-`bob` ukuthi ikhiphe noma yimuphi umyalo njengempande kunoma yimuphi umshini. Amaqembu angasetshenziswa futhi, njenge-`%admin ALL=(ALL) ALL`.

Ukuze kunikezwe izimvume ezinhle, kusetshenziswa izibizo. `User_Alias ​​​​ADMINS = alice, bob` groups users, kanye nemiyalo yamaqembu ethi `Cmnd_Alias ​​​​LOCATE = /usr/sbin/updateddb` . Bese kuthi, `ADMINS ALL = LOCATE` isetshenziswe ukuze labo basebenzisi bakwazi ukwenza leyo miyalo kuphela. Izibizo ezifana ne-`NETWORKING` zingadalelwa imiyalo efana ne-`route`, `ifconfig`, `ping`, `iptables`, njll. Lokhu kusebenzisa isimiso selungelo elincane ngaphandle kokunikeza ukufinyelela okugcwele kwezimpande kunoma ubani.

Inketho ye -NOPASSWD ikuvumela ukuthi usebenzise imiyalo ethile ngaphandle kwephasiwedi, isibonelo, `pi ALL=(ALL)`. NOPASSWD: ALL. Lokhu kulula, kodwa kuyingozi uma kusetshenziswa kabi. Ngaphezu kwalokho, ukusetshenziswa ngakunye kwe-`sudo` kuyalogwa, okusiza ukuhlola ukufinyelela nokuxazulula izinkinga. Uma kukhona okuphazamiseka, ukubuyekeza lawa malogi kungabonisa ukuthi yiluphi ushintsho lwamuva olubangele ukwehluleka.

Ukuqalisa izinhlelo zokusebenza zesithombe njengempande kusukela kusiqalisi

Kuzinhlelo ezine-interface yesithombe, ukusebenzisa nje i-`sudo` akuvamisile ukusebenza kahle ngoba akukho siphetho sokufaka iphasiwedi. Yilapho abasizi besithombe bengena khona . Ku-KDE, kukhona i-`kdesu` : uma wazi ukuthi yimuphi umyalo oqala uhlelo lokusebenza, ungasebenzisa i-`kdesu that_command`. Inketho ye-`Run Command` kumenyu ye-KDE ikuvumela futhi ukuthi uqalise uhlelo lokusebenza njengomunye umsebenzisi ngokufaka iziqinisekiso zakhe. Ezindaweni ze-GNOME kanye ne-GTK , i-`gksu` kanye ne -`gksudo` zazisetshenziswa kabanzi ; lezi yiziphetho zangaphambili ze-`sudo` noma i-`su`. Isibonelo, i-`gksu synaptic` noma i-`gksudo gparted` ivula uhlelo lokusebenza bese icela iphasiwedi.

Ezinhlelweni zesimanje, i-gksu ayikhuthazwa noma ayisetshenziswa. Indlela yayo evamile i -pkexec , esekelwe ku-PolicyKit, evumela izinhlelo ukuthi zisebenze ngamalungelo ngokwezinqubomgomo ezichaziwe. Iziqalisi eziningi zamanje zisebenzisa i-pkexec emisebenzini yokuphatha. Umqondo uyafana: umsebenzisi akudingeki avule i-terminal, kodwa uhlelo luqinisekisa ukugunyazwa ngendlela elawulwayo.

Ukuze udale isinqamuleli kusiqalisi, uhlela ifayela le -.desktop . Umugqa we-`Exec` uyisihluthulelo. Uma ufuna ukuthi isebenze njengempande, ungasebenzisa into efana ne-`Exec=gksu /path/to/program`, `Exec=kdesu /path/to/program`, noma i-`Exec=pkexec /path/to/program`. Uma usebenzisa i-`sudo` ngqo, uzodinga ukuthi isiqalisi sibe ne-`Terminal=true` noma ulungiselele i-askpass enemifanekiso. Ungazama futhi ukucindezela i-Alt+F2 bese uthayipha umsizi kanye negama lohlelo, isibonelo, `gksu synaptic`. Ku-KDE, `kdesu synaptic` noma inketho yokusebenza njengoba omunye umsebenzisi enza umsebenzi ofanayo.

Kukhona enye indlela yakudala ebizwa ngokuthi i-consolehelper , isihlanganisi sezinhlelo zokusebenza ze-GUI. Udala isixhumanisi esingokomfanekiso, isibonelo, i-/usr/bin/xterm-root ekhomba ku-/usr/sbin/consolehelper. Bese ulungiselela i-PAM ngokudala i-/etc/pam.d/xterm-root nge-auth, i-akhawunti, kanye nokufakwa kweseshini kusuka ku-config-util. Okulandelayo, uchaza i-/etc/security/console.apps/xterm-root nge-USER=root kanye ne-PROGRAM=/usr/bin/xterm. Uma usebenzisa i-xterm-root, i-consolehelper icela ukuqinisekiswa kwe-PAM bese iqala i-xterm njengempande. Uma uhlangabezana nephutha elithi "ukuxhumeka kwe-Xlib ku-:0.0 kwenqatshwe yiseva", ukusebenzisa i-xhost local:root kungasiza.

Kunoma ikuphi, ukuvula izinhlelo zokusebenza zezithombe njenge-root kunezinkinga: kuhlanganisa iziguquguquko zemvelo, kungaphula ibhasi yeseshini, kuthinte i-Wayland noma i-X11, futhi kudale amafayela aphethwe yi-root kufolda yakho yasekhaya. Kungcono ukuyisebenzisa kuphela kumathuluzi athile okuphatha bese uwavala ngokushesha nje lapho usuqedile. Ungaphequluli i-inthanethi noma uvule amadokhumenti asolisayo njenge-root , ngoba noma yikuphi ukuxhashazwa kuzozuza amalungelo aphelele.

Izibonelo ezivamile zemisebenzi edinga ukufinyelela kwezimpande

Imisebenzi eminingi yansuku zonke idinga amalungelo aphezulu. Ukuphatha amaphakheji ane-apt, zypper, dnf, noma i-yum kuvame ukudinga i-sudo. Isibonelo, `sudo apt update` , `sudo apt install firefox`, noma `sudo zypper install docker-ce`. Okufanayo kusebenza kumasevisi esistimu: `sudo systemctl restart apache2`, `sudo systemctl restart ssh`, noma `sudo systemctl restart nginx`. Ukuze ushintshe ama-akhawunti abasebenzisi, sebenzisa `sudo usermod`, futhi ukuze ushintshe ubunikazi befayela, sebenzisa `sudo chown`. Ukuhlela ukucushwa okubalulekile, njenge `/etc/ssh/sshd_config`, kudinga namalungelo ezimpande uma kwenziwa nge-nano, vim, noma i-gedit.

Awudingi i-`sudo` yemiyalo efunda ulwazi kuphela noma engashintshi uhlelo, njenge-`zypper repos` noma i-`systemctl status NetworkManager`. Ukusebenzisa i-`sudo` kukho konke okubangelwa umkhuba kuyimikhuba emibi. Into enengqondo okufanele uyenze ukuphakamisa amalungelo kuphela uma umsebenzi udinga wona bese ushintshela kumsebenzisi ojwayelekile ngokushesha okukhulu.

Izindlela ezinhle kakhulu zokusebenza ngamalungelo aphezulu

Umgomo welungelo elincane kufanele uqondise konke. Sebenzisa i-`sudo` yemiyalo ngayinye noma nini lapho kungenzeka, gwema amagobolondo ezimpande aqhubekayo ngaphandle uma kudingeka ngempela, bese uphuma ngokushesha nje lapho usuqedile. Ungasebenzisi izikripthi ezivela emithonjeni engaziwa njengempande; buyekeza ikhodi kusengaphambili, landa ezindaweni zokugcina ezisemthethweni noma kumaphrojekthi athembekile, qinisekisa amasheke, bese uhlola endaweni ehlukanisiwe uma unokungabaza. Umthamo onempilo wokungabaza uyimfanelo enhle lapho usebenza nekhodi yomuntu wesithathu enamalungelo aphelele.

Kunconywa futhi ukuthi ulungiselele ama-sudoers ngokuningiliziwe, ungathembeli kuphela eqenjini le-sudo kukho konke, futhi ugcine amalogi ehloliwe. Uma uphatha amaseva, hlola `/var/log/auth.log`, `/var/log/secure`, noma `journalctl -xe` ukuze uthole ukusetshenziswa kabi. Ezindaweni ezinabasebenzisi abaningi, ukwazi ukuthi ubani owenze umyalo ngamunye kubalulekile ekuziphenduleleni nasekulandeleni imithetho yokuphepha.

Nika amandla futhi ukhubaze impande ngekhanda

Uma unquma ukuvula ukufinyelela kwezimpande, nika iphasiwedi nge-`sudo passwd root`, isebenzisele imisebenzi ebalulekile kuphela, bese uvala kabusha i-akhawunti. Ukuze ukhubaze ukungena kwe-SSH okuqondile, hlela i-`sshd_config` bese usetha i-`PermitRootLogin no` noma i-`prohibit-password`, bese uqala kabusha i-SSH. Ukuze uvale i-akhawunti endaweni, sebenzisa i-`sudo passwd -l root`. Ukuze uyivule, sebenzisa i-`sudo passwd -u root`. Lezi zinyathelo zinciphisa indawo yokuhlasela futhi zivimbele ukuhlaselwa kwe-brute-force ngokumelene ne-akhawunti enamandla kakhulu.

Ezimweni eziningi, impendulo ewusizo yombuzo wokuqala inguyebo: ungaqala uhlelo kusukela kusiqalisi esinamalungelo ezimpande usebenzisa umsizi wesithombe njenge-kdesu, i-gksu, i-gksudo, noma i-pkexec, noma ngokudala ifayela le-.desktop elinomyalo ofanele. Kodwa-ke, lokhu akuyona into okufanele uyishiye isethelwe noma yiluphi uhlelo lokusebenza. Kungcono ukuba neziqalisi ezithile zokuphatha ezinamagama acacile futhi uzisebenzise kuphela uma kudingeka.

Okubalulekile ukuthi i-root ayiyona into yokudlala, futhi i-sudo ikhona ngqo ukuze ikunike amandla ngaphandle kokuguqula konke ukuchofoza kube ingozi ehlala njalo. Uma udinga ukuqalisa uhlelo lokusebenza olunezithombe njengomsebenzisi omkhulu, beka phambili abasizi abadinga iphasiwedi, uqinisekise ukuthi uhlelo lokusebenza luyidinga ngempela, futhi ukhawulele ukusetshenziswa kwayo emisebenzini yokuphatha. Ngale ndlela, ujabulela ukulula kwesiqalisi ngaphandle kokudela ukuphepha okwenza i-Linux ibe namandla kangaka.