课程第7/8次

botang · 发表于 2019-4-21 08:33:37

2019-04-21星期日上下午书RH124-RHEL7-zh_cn-1-20140606  P122:

visudo：限定只能被委托执行一个锁定用户的命令：
%wheel ALL=(ALL)    ALL
......
Cmnd_Alias USERL = /usr/sbin/usermod -L oracle
student  ALL=(ALL) USERL

效果：[student@station60 ~]$ sudo usermod -U  oracle
Sorry, user student is not allowed to execute '/sbin/usermod -U oracle' as root on station60.example.com.
[student@station60 ~]$-------------------------------------------------------
将一个UPG规则的用户，添加进一个新的副组，注意观察再次登录才会生效，同时umask没变：

[root@station60 ~]# su - user1
[user1@station60 ~]$ ls
Hello.txt
[user1@station60 ~]$ ls -l
total 4
-rw-r--r--. 1 user1 user1 11 Apr 20 21:12 Hello.txt
[user1@station60 ~]$ touch user1-1.txt
[user1@station60 ~]$ ls -l
total 4
-rw-r--r--. 1 user1 user1 11 Apr 20 21:12 Hello.txt
-rw-rw-r--. 1 user1 user1 0 Apr 20 21:13 user1-1.txt
[user1@station60 ~]$ id
uid=1002(user1) gid=1002(user1) groups=1002(user1) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[user1@station60 ~]$ id
uid=1002(user1) gid=1002(user1) groups=1002(user1) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[user1@station60 ~]$ exit
logout
[root@station60 ~]# su - user1
Last login: Sat Apr 20 21:12:47 EDT 2019 on pts/2
[user1@station60 ~]$ id
uid=1002(user1) gid=1002(user1) groups=1002(user1),1003(public) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[user1@station60 ~]$ umask
0002

复制代码

[student@station60 ~]$ exit
logout
[root@station60 ~]# gpasswd -a user1 public
Adding user user1 to group public
[root@station60 ~]#

复制代码

-------------------------------------如果做：userdel user1（不加-r）
清理垃圾：find / -nouser -o -nogroup------------------------------------------------------------------------------------------
远程身份验证服务器实验：准备环境：
RH134-RHEL7-zh_cn-1-20140716 P150

bash-4.2# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
bash-4.2# df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 835M 0 835M 0% /dev
tmpfs 852M 0 852M 0% /dev/shm
tmpfs 852M 9.3M 843M 2% /run
tmpfs 852M 0 852M 0% /sys/fs/cgroup
/dev/sda2 19G 7.4G 9.9G 43% /
/dev/sda1 497M 213M 285M 43% /boot
tmpfs 171M 28K 171M 1% /run/user/0
/dev/sr0 4.3G 4.3G 0 100% /mnt
bash-4.2# cd /etc/
bash-4.2# cd yum.repos.d/
bash-4.2# ls
public-yum-ol7.repo
bash-4.2# mkdir test
bash-4.2# ls
public-yum-ol7.repo test
bash-4.2# mv public-yum-ol7.repo test/
bash-4.2# ls
test
bash-4.2# vim base.repo
bash-4.2# yum list "sssd*"
Loaded plugins: langpacks, ulninfo
Existing lock /var/run/yum.pid: another copy is running as pid 17836.
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:24 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:26 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:28 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:30 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:32 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:34 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:36 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:38 ago
State : Sleeping, pid: 17836
^C
Exiting on user cancel.
bash-4.2# yum clean all
Loaded plugins: langpacks, ulninfo
Existing lock /var/run/yum.pid: another copy is running as pid 17836.
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:43 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:45 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:47 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:49 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:51 ago
State : Sleeping, pid: 17836
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: PackageKit
Memory : 210 M RSS (631 MB VSZ)
Started: Sun Apr 21 09:14:07 2019 - 05:53 ago
State : Sleeping, pid: 17836
^C
Exiting on user cancel.
bash-4.2# cd /var/run/
bash-4.2# ls
abrt dmeventd-client log rhnsd.pid syslogd.pid
alsactl.pid dmeventd-server lsm rpcbind systemd
atd.pid ebtables.lock lvm rpcbind.lock tmpfiles.d
auditd.pid faillock lvmetad.pid rpcbind.sock tuned
avahi-daemon firewalld mcelog-client samba udev
chrony gdm mcelog.pid sepermit udisks2
chronyd.pid gssproxy.pid mdadm setrans user
console gssproxy.sock media setroubleshoot utmp
crond.pid initramfs mount sm-notify.pid vmware
cron.reboot ksmtune.pid netreport spice-vdagentd xtables.lock
cryptsetup libvirt plymouth sshd.pid yum.pid
cups libvirtd.pid ppp sudo
dbus lock radvd sysconfig
bash-4.2# rm -i yum.pid
rm: remove regular file ‘yum.pid’? y
bash-4.2# yum list "sssd*"
Loaded plugins: langpacks, ulninfo
Base | 3.6 kB 00:00
(1/2): Base/group_gz | 144 kB 00:00
(2/2): Base/primary_db | 5.0 MB 00:00
Installed Packages
sssd-client.x86_64 1.16.2-13.el7 @anaconda/7.6
Available Packages
sssd.x86_64 1.16.2-13.el7 Base
sssd-ad.x86_64 1.16.2-13.el7 Base
sssd-client.i686 1.16.2-13.el7 Base
sssd-common.x86_64 1.16.2-13.el7 Base
sssd-common-pac.x86_64 1.16.2-13.el7 Base
sssd-dbus.x86_64 1.16.2-13.el7 Base
sssd-ipa.x86_64 1.16.2-13.el7 Base
sssd-kcm.x86_64 1.16.2-13.el7 Base
sssd-krb5.x86_64 1.16.2-13.el7 Base
sssd-krb5-common.x86_64 1.16.2-13.el7 Base
sssd-ldap.x86_64 1.16.2-13.el7 Base
sssd-libwbclient.x86_64 1.16.2-13.el7 Base
sssd-polkit-rules.x86_64 1.16.2-13.el7 Base
sssd-proxy.x86_64 1.16.2-13.el7 Base
sssd-tools.x86_64 1.16.2-13.el7 Base
sssd-winbind-idmap.x86_64 1.16.2-13.el7 Base
bash-4.2# yum -y install sssd.x86_64
Loaded plugins: langpacks, ulninfo
Resolving Dependencies
--> Running transaction check
---> Package sssd.x86_64 0:1.16.2-13.el7 will be installed
--> Processing Dependency: sssd-proxy = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Processing Dependency: sssd-ldap = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Processing Dependency: sssd-krb5 = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Processing Dependency: sssd-ipa = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Processing Dependency: sssd-common = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Processing Dependency: sssd-ad = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Processing Dependency: python-sssdconfig = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
--> Running transaction check
---> Package python-sssdconfig.noarch 0:1.16.2-13.el7 will be installed
---> Package sssd-ad.x86_64 0:1.16.2-13.el7 will be installed
--> Processing Dependency: sssd-krb5-common = 1.16.2-13.el7 for package: sssd-ad-1.16.2-13.el7.x86_64
--> Processing Dependency: sssd-common-pac = 1.16.2-13.el7 for package: sssd-ad-1.16.2-13.el7.x86_64
--> Processing Dependency: libdhash.so.1(DHASH_0.4.3)(64bit) for package: sssd-ad-1.16.2-13.el7.x86_64
--> Processing Dependency: libsss_certmap.so.0()(64bit) for package: sssd-ad-1.16.2-13.el7.x86_64
--> Processing Dependency: libdhash.so.1()(64bit) for package: sssd-ad-1.16.2-13.el7.x86_64
---> Package sssd-common.x86_64 0:1.16.2-13.el7 will be installed
--> Processing Dependency: libsss_sudo(x86-64) = 1.16.2-13.el7 for package: sssd-common-1.16.2-13.el7.x86_64
--> Processing Dependency: libsss_autofs(x86-64) = 1.16.2-13.el7 for package: sssd-common-1.16.2-13.el7.x86_64
--> Processing Dependency: libhttp_parser_strict.so.2()(64bit) for package: sssd-common-1.16.2-13.el7.x86_64
--> Processing Dependency: libcares.so.2()(64bit) for package: sssd-common-1.16.2-13.el7.x86_64
---> Package sssd-ipa.x86_64 0:1.16.2-13.el7 will be installed
--> Processing Dependency: libipa_hbac(x86-64) = 1.16.2-13.el7 for package: sssd-ipa-1.16.2-13.el7.x86_64
--> Processing Dependency: libipa_hbac.so.0(IPA_HBAC_0.1.0)(64bit) for package: sssd-ipa-1.16.2-13.el7.x86_64
--> Processing Dependency: libipa_hbac.so.0(IPA_HBAC_0.0.1)(64bit) for package: sssd-ipa-1.16.2-13.el7.x86_64
--> Processing Dependency: libipa_hbac.so.0()(64bit) for package: sssd-ipa-1.16.2-13.el7.x86_64
---> Package sssd-krb5.x86_64 0:1.16.2-13.el7 will be installed
---> Package sssd-ldap.x86_64 0:1.16.2-13.el7 will be installed
---> Package sssd-proxy.x86_64 0:1.16.2-13.el7 will be installed
--> Running transaction check
---> Package c-ares.x86_64 0:1.10.0-3.el7 will be installed
---> Package http-parser.x86_64 0:2.7.1-5.el7_4 will be installed
---> Package libdhash.x86_64 0:0.5.0-32.el7 will be installed
---> Package libipa_hbac.x86_64 0:1.16.2-13.el7 will be installed
---> Package libsss_autofs.x86_64 0:1.16.2-13.el7 will be installed
---> Package libsss_certmap.x86_64 0:1.16.2-13.el7 will be installed
---> Package libsss_sudo.x86_64 0:1.16.2-13.el7 will be installed
---> Package sssd-common-pac.x86_64 0:1.16.2-13.el7 will be installed
---> Package sssd-krb5-common.x86_64 0:1.16.2-13.el7 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
sssd x86_64 1.16.2-13.el7 Base 134 k
Installing for dependencies:
c-ares x86_64 1.10.0-3.el7 Base 77 k
http-parser x86_64 2.7.1-5.el7_4 Base 27 k
libdhash x86_64 0.5.0-32.el7 Base 28 k
libipa_hbac x86_64 1.16.2-13.el7 Base 142 k
libsss_autofs x86_64 1.16.2-13.el7 Base 144 k
libsss_certmap x86_64 1.16.2-13.el7 Base 170 k
libsss_sudo x86_64 1.16.2-13.el7 Base 142 k
python-sssdconfig noarch 1.16.2-13.el7 Base 160 k
sssd-ad x86_64 1.16.2-13.el7 Base 263 k
sssd-common x86_64 1.16.2-13.el7 Base 1.4 M
sssd-common-pac x86_64 1.16.2-13.el7 Base 204 k
sssd-ipa x86_64 1.16.2-13.el7 Base 352 k
sssd-krb5 x86_64 1.16.2-13.el7 Base 175 k
sssd-krb5-common x86_64 1.16.2-13.el7 Base 209 k
sssd-ldap x86_64 1.16.2-13.el7 Base 227 k
sssd-proxy x86_64 1.16.2-13.el7 Base 169 k
Transaction Summary
================================================================================
Install 1 Package (+16 Dependent packages)
Total download size: 3.9 M
Installed size: 7.0 M
Downloading packages:
--------------------------------------------------------------------------------
Total 19 MB/s | 3.9 MB 00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : libdhash-0.5.0-32.el7.x86_64 1/17
Installing : libsss_certmap-1.16.2-13.el7.x86_64 2/17
Installing : libsss_autofs-1.16.2-13.el7.x86_64 3/17
Installing : python-sssdconfig-1.16.2-13.el7.noarch 4/17
Installing : c-ares-1.10.0-3.el7.x86_64 5/17
Installing : http-parser-2.7.1-5.el7_4.x86_64 6/17
Installing : libipa_hbac-1.16.2-13.el7.x86_64 7/17
Installing : libsss_sudo-1.16.2-13.el7.x86_64 8/17
Installing : sssd-common-1.16.2-13.el7.x86_64 9/17
Installing : sssd-krb5-common-1.16.2-13.el7.x86_64 10/17
Installing : sssd-common-pac-1.16.2-13.el7.x86_64 11/17
Installing : sssd-ad-1.16.2-13.el7.x86_64 12/17
Installing : sssd-ipa-1.16.2-13.el7.x86_64 13/17
Installing : sssd-krb5-1.16.2-13.el7.x86_64 14/17
Installing : sssd-ldap-1.16.2-13.el7.x86_64 15/17
Installing : sssd-proxy-1.16.2-13.el7.x86_64 16/17
Installing : sssd-1.16.2-13.el7.x86_64 17/17
Verifying : sssd-krb5-1.16.2-13.el7.x86_64 1/17
Verifying : libsss_sudo-1.16.2-13.el7.x86_64 2/17
Verifying : sssd-common-pac-1.16.2-13.el7.x86_64 3/17
Verifying : sssd-proxy-1.16.2-13.el7.x86_64 4/17
Verifying : libipa_hbac-1.16.2-13.el7.x86_64 5/17
Verifying : http-parser-2.7.1-5.el7_4.x86_64 6/17
Verifying : sssd-1.16.2-13.el7.x86_64 7/17
Verifying : libsss_certmap-1.16.2-13.el7.x86_64 8/17
Verifying : sssd-common-1.16.2-13.el7.x86_64 9/17
Verifying : sssd-ad-1.16.2-13.el7.x86_64 10/17
Verifying : libdhash-0.5.0-32.el7.x86_64 11/17
Verifying : c-ares-1.10.0-3.el7.x86_64 12/17
Verifying : python-sssdconfig-1.16.2-13.el7.noarch 13/17
Verifying : libsss_autofs-1.16.2-13.el7.x86_64 14/17
Verifying : sssd-ldap-1.16.2-13.el7.x86_64 15/17
Verifying : sssd-ipa-1.16.2-13.el7.x86_64 16/17
Verifying : sssd-krb5-common-1.16.2-13.el7.x86_64 17/17
Installed:
sssd.x86_64 0:1.16.2-13.el7
Dependency Installed:
c-ares.x86_64 0:1.10.0-3.el7
http-parser.x86_64 0:2.7.1-5.el7_4
libdhash.x86_64 0:0.5.0-32.el7
libipa_hbac.x86_64 0:1.16.2-13.el7
libsss_autofs.x86_64 0:1.16.2-13.el7
libsss_certmap.x86_64 0:1.16.2-13.el7
libsss_sudo.x86_64 0:1.16.2-13.el7
python-sssdconfig.noarch 0:1.16.2-13.el7
sssd-ad.x86_64 0:1.16.2-13.el7
sssd-common.x86_64 0:1.16.2-13.el7
sssd-common-pac.x86_64 0:1.16.2-13.el7
sssd-ipa.x86_64 0:1.16.2-13.el7
sssd-krb5.x86_64 0:1.16.2-13.el7
sssd-krb5-common.x86_64 0:1.16.2-13.el7
sssd-ldap.x86_64 0:1.16.2-13.el7
sssd-proxy.x86_64 0:1.16.2-13.el7
Complete!
bash-4.2# systemctl -l | grep sssd
bash-4.2# systemctl -l
UNIT
proc-sys-fs-binfmt_misc.automount
sys-devices-pci0000:00-0000:00:10.0-host0-target0:0:0-0:0:0:0-block-sda-sda1.dev
sys-devices-pci0000:00-0000:00:10.0-host0-target0:0:0-0:0:0:0-block-sda-sda2.dev
sys-devices-pci0000:00-0000:00:10.0-host0-target0:0:0-0:0:0:0-block-sda-sda3.dev
sys-devices-pci0000:00-0000:00:10.0-host0-target0:0:0-0:0:0:0-block-sda.device
sys-devices-pci0000:00-0000:00:11.0-0000:02:00.0-usb2-2\x2d2-2\x2d2.1-2\x2d2.1:1
sys-devices-pci0000:00-0000:00:11.0-0000:02:00.0-usb2-2\x2d2-2\x2d2.1-2\x2d2.1:1
sys-devices-pci0000:00-0000:00:11.0-0000:02:01.0-net-ens33.device
sys-devices-pci0000:00-0000:00:11.0-0000:02:02.0-sound-card0.device
sys-devices-pci0000:00-0000:00:11.0-0000:02:05.0-ata4-host4-target4:0:0-4:0:0:0-
sys-devices-platform-serial8250-tty-ttyS1.device
sys-devices-platform-serial8250-tty-ttyS2.device
sys-devices-platform-serial8250-tty-ttyS3.device
sys-devices-pnp0-00:05-tty-ttyS0.device
sys-devices-virtual-net-virbr0.device
sys-devices-virtual-net-virbr0\x2dnic.device
sys-module-configfs.device
sys-module-fuse.device
sys-subsystem-bluetooth-devices-hci0.device
sys-subsystem-net-devices-ens33.device
sys-subsystem-net-devices-virbr0.device
sys-subsystem-net-devices-virbr0\x2dnic.device
sys-subsystem-rfkill-devices-rfkill0.device
-.mount
boot.mount
dev-hugepages.mount
dev-mqueue.mount
mnt.mount
run-media-root-OL\x2d7.6\x20Server.x86_64.mount
run-user-0-gvfs.mount
run-user-0.mount
sys-fs-fuse-connections.mount
sys-kernel-config.mount
sys-kernel-debug.mount
var-lib-nfs-rpc_pipefs.mount
bash-4.2# service sssd status
Redirecting to /bin/systemctl status sssd.service
● sssd.service - System Security Services Daemon
Loaded: loaded (/usr/lib/systemd/system/sssd.service; disabled; vendor preset: disabled)
Active: inactive (dead)
bash-4.2# service sssd start
Redirecting to /bin/systemctl start sssd.service
bash-4.2# systemctl -l | grep sssd
sssd.service loaded active running System Security Services Daemon
bash-4.2# systemctl enable sssd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/sssd.service to /usr/lib/systemd/system/sssd.service.
bash-4.2#

复制代码

RH134 P150:

bash-4.2# yum list "authconfig*"
Loaded plugins: langpacks, ulninfo
Installed Packages
authconfig.x86_64 6.2.8-30.el7 @anaconda/7.6
Available Packages
authconfig-gtk.x86_64 6.2.8-30.el7 Base
bash-4.2# yum -y install authconfig-gtk.x86_64
Loaded plugins: langpacks, ulninfo
Resolving Dependencies
--> Running transaction check
---> Package authconfig-gtk.x86_64 0:6.2.8-30.el7 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
authconfig-gtk x86_64 6.2.8-30.el7 Base 109 k
Transaction Summary
================================================================================
Install 1 Package
Total download size: 109 k
Installed size: 247 k
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : authconfig-gtk-6.2.8-30.el7.x86_64 1/1
Verifying : authconfig-gtk-6.2.8-30.el7.x86_64 1/1
Installed:
authconfig-gtk.x86_64 0:6.2.8-30.el7
Complete!
bash-4.2#

复制代码

RH134 P159

进一步配 Kerberos:

stormempire · 发表于 2019-4-21 08:46:23

齐昕 86633561@qq.com

rhce小学徒海涛 · 发表于 2019-4-21 08:46:53

本帖最后由 rhce小学徒海涛于 2019-4-21 09:20 编辑

上课占坑报道，坐等录屏

514237580@qq.com

lint · 发表于 2019-4-21 08:49:54

林涛
786426@qq.com

Perfect利云 · 发表于 2019-5-8 09:39:05

上次忘记在论坛留自己邮箱了···刘翔735663781@qq.com