On Unix-like operating systems, the visudo command edits the sudoers file, which is used by the sudo command. To change what users and groups are allowed to run sudo, run visudo.
visudo edits the sudoers file, which defines the users and groups with administrator rights.
Visudo edits the sudoers file in a safe fashion, similar to the way that vipw safely edits the passwd file. Visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks for parse errors. If the sudoers file is currently being edited by someone else, or by you in another session, you will receive a message to try again later.
There is a hard-coded list of one or more editors that visudo uses, set at compile-time. The default is vi.
Note
By default, visudo doesn't honor the VISUAL or EDITORenvironment variables, used by many programs to determine the default text editor. However, if visudo is configured with the --with-env-editor option or the env_editor Default variable is set in the sudoers file, visudo uses any of the editors defined by VISUAL or EDITOR. Doing so can make your system vulnerable to a security breech, however, because it allows the user to execute any program they want by setting VISUAL or EDITOR.
Visudo parses the sudoers file after the edit, and will not save the changes if there is a syntax error. Upon finding an error, visudo prints a message stating the line number(s) where the error occurred and the user will receive the "What now?" prompt. At the prompt, type e to re-edit the sudoers file, x to exit without saving the changes, or Q to quit and save changes. The "Q" option should be used with extreme care, because if visudo finds a parse error, so will sudo, and no one can run sudo again until the error is fixed. If "e" is typed to edit the sudoers file after a parse error is detected, the cursor will be placed on the line where the error occurred, if the editor supports this feature.
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
在這里，“ root ALL =（ALL：ALL）ALL ”表明登錄到任何主機名的用戶root可以作為任何用戶或組作為任何命令運行。該指令的一般形式為：
userhostname=(runas-user:runas-group)command
特殊詞ALL可以用于這些值中的任何一個，并且表示允許任何一個。
如果user以％開頭，則將其解釋為組的名稱，該指令適用于該組中的所有用戶。因此，“ ％admin ALL =（ALL）ALL ”行允許屬于組admin的任何用戶以任何用戶或組的身份運行任何命令。在三行之后，為組sudo的成員定義了相同的權限。
Enable check-only mode. The existing sudoers file will be checked for syntax errors, owner and mode. A message will be printed to the standard output describing the status of sudoers unless the -q option was specified. If the check completes successfully, visudo will exit with a value of 0. If an error is encountered, visudo will exit with a value of 1.
-fsudoers
Specify an alternate sudoers file location. With this option, visudo will edit (or check) the sudoers file of your choice, instead of the default, /etc/sudoers. The lock file used is the specified sudoers file with ".tmp" appended to it. In check-only mode only, the argument to -f may be -, indicating that sudoers will be read from the standard input.
-h
The -h (help) option causes visudo to print a short help message to the standard output and exit.
-q
Enable quiet mode. In this mode details about syntax errors are not printed. This option is only useful when combined with the -c option.
-s
Enable strict checking of the sudoers file. If an alias is used before it is defined, visudo will consider this a parse error. Note that it is not possible to differentiate between an alias and a hostname or username that consists solely of uppercase letters, digits, and the underscore (‘_’) character.
-V
The -V (version) option causes visudo to print its version number and exit.
The sudoers file
A typical sudoers file looks like this:
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
Here, "root ALL=(ALL:ALL) ALL" states that the user root, logged in to any hostname, may run, as any user or group, any command. The general form of this directive is:
userhostname=(runas-user:runas-group)command
The special word ALL may be used for any of these values, and means that any are allowed.
If user begins with a %, it's interpreted as the name of a group, and the directive applies to all users in that group. So the line "%admin ALL=(ALL) ALL" allows any user belonging to the group admin to run any command as any user or group. The same permissions are defined for members of group sudo, three lines later.
So, with this configuration, if you want a user to have sudo rights, you can add them to the admin or sudo group, and don't need to edit sudoers at all. In this case, the command:
usermod -aG sudo hope
Would grant sudo rights to the user hope next time they log in. For more information about how to use usermod to change a user's group membership, see the usermod command.
If you don't want to have a dedicated sudo group, you can define sudo rights for a user directly in sudoers, by adding a line anywhere in the file. To give user hope full sudo access, for instance, add:
hope ALL=(ALL:ALL) ALL
Then save the file and exit the text editor launched by visudo.
Important files
/etc/sudoers
Permissions configuration for the sudo command.
/etc/sudoers.tmp
The lock file, which prevents multiple simultaneous edits to sudoers.
To edit the sudoers file, run visudo as root. Switch user to root with su (requires the root password, which is different than your user password):
su
Password:
Then run visudo:
visudo
Or if you already have sudo rights, run visudo with sudo:
sudo visudo
[sudo] password for user:
Sudoer directives
The following are examples of lines added to sudoers when you run visudo:
hope ALL=(ALL:ALL) ALL
User hope can run all commands as any user or group, logged in to any host that this configuration applies.
%hope ALL=(ALL:ALL) ALL
Same as above, except the permission apply to any member of the group hope (which may or may not include user hope).
hope myhost=(mysqluser:mysqlusers) mysqldump
User hope, when logged in to host myhost, may run the command mysqldump as user mysqluser or a member of group mysqlusers. For example, this directive would allow user hope to run this command:
visudo (編輯sudoers文件，該文件由sudo命令使用)
在類似Unix的操作系統上，visudo命令編輯sudoers文件，該文件由sudo命令使用。要更改允許哪些用戶和組運行sudo，請運行visudo。
On Unix-like operating systems, the visudo command edits the sudoers file, which is used by the sudo command. To change what users and groups are allowed to run sudo, run visudo.
查看英文版
查看中文版
1 visudo 運行系統環境
2 visudo 描述
3 visudo 語法
4 visudo 例子
visudo 運行系統環境
Unix&Linux
visudo 描述
visudo編輯sudoers文件，該文件定義具有管理員權限的用戶和組。
Visudo以安全的方式編輯sudoers文件，類似于vipw安全地編輯passwd文件的方式。Visudo鎖定sudoers文件以防止同時進行多次編輯，提供基本的完整性檢查并檢查解析錯誤。如果當前正在由其他人或您在另一個會話中編輯sudoers文件，您將收到一條消息，稍后再試。
在編譯時設置了visudo使用的一個或多個編輯器的硬編碼列表。默認值為vi。
默認情況下，visudo不支持許多程序用來確定默認文本編輯器的VISUAL或EDITOR 環境變量。但是，如果使用--with-env-editor選項配置visudo或在sudoers文件中設置了env_editor Default變量，則visudo使用VISUAL或EDITOR定義的任何編輯器。但是，這樣做會使您的系統容易受到安全漏洞的攻擊，因為它允許用戶通過設置VISUAL或EDITOR來執行他們想要的任何程序。
編輯后，Visudo會解析sudoers文件，如果存在語法錯誤，Visudo將不會保存更改。發現錯誤后，visudo打印一條消息，指出發生錯誤的行號，并且用戶將收到“現在如何？”。提示。在提示符下，鍵入e重新編輯sudoers文件，鍵入x退出而不保存更改，或者鍵入Q退出并保存更改。應該非常小心地使用“ Q”選項，因為如果visudo發現一個解析錯誤，那么sudo也會出現，并且沒有人可以運行sudo再次，直到錯誤得到解決。如果在檢測到解析錯誤后鍵入“ e”以編輯sudoers文件，則如果編輯器支持此功能，則光標將放置在發生錯誤的行上。
visudo edits the sudoers file, which defines the users and groups with administrator rights.
Visudo edits the sudoers file in a safe fashion, similar to the way that vipw safely edits the passwd file. Visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks for parse errors. If the sudoers file is currently being edited by someone else, or by you in another session, you will receive a message to try again later.
There is a hard-coded list of one or more editors that visudo uses, set at compile-time. The default is vi.
By default, visudo doesn't honor the VISUAL or EDITOR environment variables, used by many programs to determine the default text editor. However, if visudo is configured with the --with-env-editor option or the env_editor Default variable is set in the sudoers file, visudo uses any of the editors defined by VISUAL or EDITOR. Doing so can make your system vulnerable to a security breech, however, because it allows the user to execute any program they want by setting VISUAL or EDITOR.
Visudo parses the sudoers file after the edit, and will not save the changes if there is a syntax error. Upon finding an error, visudo prints a message stating the line number(s) where the error occurred and the user will receive the "What now?" prompt. At the prompt, type e to re-edit the sudoers file, x to exit without saving the changes, or Q to quit and save changes. The "Q" option should be used with extreme care, because if visudo finds a parse error, so will sudo, and no one can run sudo again until the error is fixed. If "e" is typed to edit the sudoers file after a parse error is detected, the cursor will be placed on the line where the error occurred, if the editor supports this feature.
查看英文版
查看中文版
visudo 語法
選件
sudoers文件
一個典型的sudoers文件如下所示：
在這里，“ root ALL =（ALL：ALL）ALL ”表明登錄到任何主機名的用戶root可以作為任何用戶或組作為任何命令運行。該指令的一般形式為：
特殊詞ALL可以用于這些值中的任何一個，并且表示允許任何一個。
如果user以％開頭，則將其解釋為組的名稱，該指令適用于該組中的所有用戶。因此，“ ％admin ALL =（ALL）ALL ”行允許屬于組admin的任何用戶以任何用戶或組的身份運行任何命令。在三行之后，為組sudo的成員定義了相同的權限。
因此，使用此配置，如果您希望用戶具有sudo權限，則可以將其添加到admin或sudo組中，而根本不需要編輯sudoer。在這種情況下，命令：
將向用戶希望下次登錄時授予sudo權限。有關如何使用usermod更改用戶的組成員身份的更多信息，請參見usermod命令。
如果您不想擁有專用的sudo組，則可以通過在文件中的任意位置添加一行來直接在sudoers中為用戶定義sudo權限。例如，要給用戶希望完全的sudo訪問權限，請添加：
然后保存文件并退出visudo啟動的文本編輯器。
重要檔案
Options
The sudoers file
A typical sudoers file looks like this:
Here, "root ALL=(ALL:ALL) ALL" states that the user root, logged in to any hostname, may run, as any user or group, any command. The general form of this directive is:
The special word ALL may be used for any of these values, and means that any are allowed.
If user begins with a %, it's interpreted as the name of a group, and the directive applies to all users in that group. So the line "%admin ALL=(ALL) ALL" allows any user belonging to the group admin to run any command as any user or group. The same permissions are defined for members of group sudo, three lines later.
So, with this configuration, if you want a user to have sudo rights, you can add them to the admin or sudo group, and don't need to edit sudoers at all. In this case, the command:
Would grant sudo rights to the user hope next time they log in. For more information about how to use usermod to change a user's group membership, see the usermod command.
If you don't want to have a dedicated sudo group, you can define sudo rights for a user directly in sudoers, by adding a line anywhere in the file. To give user hope full sudo access, for instance, add:
Then save the file and exit the text editor launched by visudo.
Important files
查看英文版
查看中文版
visudo 例子
要編輯sudoers文件，請以root用戶身份運行visudo。使用su將用戶切換為root （需要root密碼，該密碼與您的用戶密碼不同）：
然后運行visudo：
或者，如果您已經擁有sudo權限，請使用sudo運行visudo：
Sudoer指令
以下是運行visudo時添加到sudoers的行的示例：
用戶hope可以以任何用戶或組的身份運行所有命令，并登錄到此配置適用的任何主機。
與上述相同，不同之處在于該許可適用于組hope的任何成員（可能包括或可能不包括用戶hope）。
用戶hope登錄到主機myhost后，可以以用戶mysqluser或mysqlusers組的成員身份運行mysqldump命令。例如，此偽指令將允許用戶hope運行以下命令：
To edit the sudoers file, run visudo as root. Switch user to root with su (requires the root password, which is different than your user password):
Then run visudo:
Or if you already have sudo rights, run visudo with sudo:
Sudoer directives
The following are examples of lines added to sudoers when you run visudo:
User hope can run all commands as any user or group, logged in to any host that this configuration applies.
Same as above, except the permission apply to any member of the group hope (which may or may not include user hope).
User hope, when logged in to host myhost, may run the command mysqldump as user mysqluser or a member of group mysqlusers. For example, this directive would allow user hope to run this command:
查看英文版
查看中文版
其他命令行
vmstat | vim\gview\gvim | vacation | vgrind | vipw | vi |