97 lines
2.9 KiB
Plaintext
97 lines
2.9 KiB
Plaintext
#
|
|
# Sample /etc/sudoers file.
|
|
#
|
|
# This file MUST be edited with the 'visudo' command as root.
|
|
#
|
|
# See the man page for the details on how to write a sudoers file.
|
|
#
|
|
|
|
##
|
|
# User alias specification
|
|
##
|
|
User_Alias FULLTIMERS=millert,mikef,dowdy
|
|
User_Alias PARTTIMERS=bostley,jwfox,mccreary
|
|
|
|
##
|
|
# Runas alias specification
|
|
##
|
|
Runas_Alias OP=root,operator
|
|
|
|
##
|
|
# Cmnd alias specification
|
|
##
|
|
Cmnd_Alias DUMPS=/usr.sbin/dump,/usr.sbin/rdump,/usr.sbin/restore,\
|
|
/usr.sbin/rrestore,/usr/bin/mt
|
|
Cmnd_Alias KILL=/usr/bin/kill
|
|
Cmnd_Alias PRINTING=/usr.sbin/lpc,/usr.bin/lprm
|
|
Cmnd_Alias SHUTDOWN=/usr.sbin/shutdown
|
|
Cmnd_Alias HALT=/usr.sbin/halt,/usr.sbin/fasthalt
|
|
Cmnd_Alias REBOOT=/usr.sbin/reboot,/usr.sbin/fastboot
|
|
Cmnd_Alias SHELLS=/usr/bin/sh,/usr/bin/csh,/usr/bin/ksh,\
|
|
/usr/local/bin/tcsh,/usr.bin/rsh,\
|
|
/usr/local/bin/zsh
|
|
Cmnd_Alias SU=/usr/bin/su
|
|
Cmnd_Alias VIPW=/usr.sbin/vipw,/usr/sbin/vipw,/usr/bin/passwd
|
|
|
|
##
|
|
# Host alias specification
|
|
##
|
|
Host_Alias SUN4=bruno,eclipse,moet,anchor
|
|
Host_Alias SUN3=brazil,columbine
|
|
Host_Alias DECSTATION=wilkinson,soma,dendrite,thang
|
|
Host_Alias DECALPHA=widget,thalamus,foobar
|
|
Host_Alias HPSNAKE=boa,nag,python
|
|
Host_Alias CUNETS=128.138.0.0/255.255.0.0
|
|
Host_Alias CSNETS=128.138.243.0,128.138.204.0,128.138.242.0
|
|
Host_Alias SEVERS=master,mail,www,ns
|
|
|
|
##
|
|
# User specification
|
|
##
|
|
|
|
# root and users in group wheel can run anything on any machine as any user
|
|
root ALL=(ALL) ALL
|
|
%wheel ALL=(ALL) ALL
|
|
|
|
# full time sysadmins can run anything on any machine without a password
|
|
FULLTIMERS ALL=NOPASSWD:ALL
|
|
# part time sysadmins may run anything except root shells or su
|
|
PARTTIMERS ALL=ALL,!SU,!SHELLS
|
|
|
|
# rodney may run anything except root shells or su on machines in CSNETS
|
|
rodney CSNETS=ALL,!SU,!SHELLS
|
|
|
|
# smartguy may run any command on any host in CUNETS (call B address)
|
|
smartguy CUNETS=ALL
|
|
|
|
# operator may run maintenance commands and anything in /usr/oper/bin/
|
|
operator ALL=DUMPS,KILL,PRINTING,SHUTDOWN,HALT,REBOOT,/usr/oper/bin/
|
|
|
|
# joe may su only to operator
|
|
joe ALL=SU operator
|
|
|
|
# pete may change passwords for anyone but root
|
|
pete ALL=/usr/bin/passwd [A-z]*,!/usr/bin/passwd root
|
|
|
|
# bob may run anything except root shells or su on the sun3 and sun4 machines
|
|
# as any user in the Runas_Alias "OP" (contains root and operator)
|
|
bob SUN4=(OP) ALL, !SU, !SHELLS:\
|
|
SUN3=(OP) ALL, !SU, !SHELLS
|
|
|
|
# jim may run anything on machines in the biglab netgroup
|
|
jim +biglab=ALL
|
|
|
|
# users in the secretaries netgroup need to help manage the printers
|
|
+secretaries ALL=PRINTING
|
|
|
|
# fred can run commands as oracle by specifying -u oracle on command line
|
|
# without a password but cannot run su or any shells
|
|
fred ALL=(oracle) NOPASSWD:ALL, !SU, !SHELLS
|
|
|
|
# john may su to anyone but root and flags are not allowed
|
|
john ALL=SU [!-]*, !SU *root*
|
|
|
|
# killroy can run all but shells and su on all machines but those
|
|
# in the "SERVERS" Host_Alias
|
|
killroy ALL,!SERVERS=ALL, !SU, !SHELLS
|