获取超级用户访问权限

Root用户：

在redhat7.2中root用户特权高于文件系统上的一般特权，用于管理系统，要执行诸如安装或删除软件以及管理系统文件和目录等任务时，必须将特权升级到root用户。

大多数设备都受root用户控制，但也有些设备并非如此。例如：USB移动设备就可以受一般用户控制，默认情况下只有root用户可以管理“固定”磁盘。

Linux上的root账户大致相当于windows上本地的admin账户。在linux系统中大多数管理员登录到非特权账户（root），然后使用各种工具（su，sudo，polickit）获得root权限。

利用su切换账户：

SU命令：

切换用户，未指定用户名即切换到root用户，当普通用户调用root用户时需要输入root用户密码。SU - ：切换用户后切换工作目录，环境设置为以该用户登录完全一致，而su 仅以该用户身份使用当前的环境设置启动shell。

su -c : 该命令作用等同与windows里的runas一样，能够用另一个用户身份执行任意程序。

su 缺陷：普通用户使用使用时需要输入root用户密码。

sudo命令:

可以使用户根据/etc/sudoers 文件中的设置，而被允许以root或其他用户身份运行命令。sudo 要求用户输入自己的密码进行身份验证，而不是输入root用户密码。这样可以让管理员将细微的权限用户来委派系统管理任务，而无需root用户密码。

例如：如果sudo 已配置为允许redhat用户root身份运行usermod命令，那么redhat就可以运行一下命令锁定用户账户。

sudo都提供了一个编辑该文件的命令：visudo来对该文件进行修改，出现配置错误会有提示，使用方法同vim类似。

/etc/sudoers文件详解

1 ## Sudoers allows particular users to run various commands as2 ## the root user, without needing the root password.3 ##  //无需root用户密码执行各种只有root用户才可以执行的命令4 ## Examples are provided at the bottom of the file for collections5 ## of related commands, which can then be delegated out to particular6 ## users or groups.  //用户所用组7 ## 8 ## This file must be edited with the 'visudo' command.9 10 ## Host Aliases11 ## Groups of machines. You may prefer to use hostnames (perhaps using 12 ## wildcards for entire domains) or IP addresses instead.13 # Host_Alias     FILESERVERS = fs1, fs214 # Host_Alias     MAILSERVERS = smtp, smtp215 16 ## User Aliases17 ## These aren't often necessary, as you can use regular groups18 ## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 19 ## rather than USERALIAS20 # User_Alias ADMINS = jsmith, mikem21 22 23 # Command Aliases24 ## These are groups of related commands...25 26 ## Networking    //网络操作相关命令别名27 # Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool28 29 ## Installation and management of software30 # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum31 32 ## Services  //服务器相关命令别名34 35 ## Updating the locate database //本地数据库升级命令别名36 # Cmnd_Alias LOCATE = /usr/bin/updatedb37 38 ## Storage39 # Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount  //磁盘操作命令别名40 41 ## Delegating permissions //代理权限相关别名42 # Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 43 44 ## Processes45 # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall46 47 ## Drivers  //进程相关命令别名48 # Cmnd_Alias DRIVERS = /sbin/modprobe49 50 # Defaults specification51 52 #53 # Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 54 #         You have to run "ssh -t hostname sudo <cmd>".55 #56 Defaults    requiretty57 58 #59 # Refuse to run if unable to disable echo on the tty. This setting should also be60 # changed in order to be able to use sudo without a tty. See requiretty above.61 #62 Defaults   !visiblepw63 64 #65 # Preserving HOME has security implications since many programs66 # use it when searching for configuration files. Note that HOME67 # is already set when the the env_reset option is enabled, so68 # this option is only effective for configurations where either69 # env_reset is disabled or HOME is present in the env_keep list.70 #71 Defaults    always_set_home72 73 Defaults    env_reset74 Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"75 Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"76 Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"77 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"78 Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"79 80 #81 # Adding HOME to env_keep may enable a user to run unrestricted82 # commands via sudo.83 #84 # Defaults   env_keep += "HOME"85 86 Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin87 88 ## Next comes the main part: which users can run what software on 89 ## which machines (the sudoers file can be shared between multiple90 ## systems).91 ## Syntax:92 ##93 ##      user    MACHINE=COMMANDS94 ##95 ## The COMMANDS section may have other options added to it.80 #81 # Adding HOME to env_keep may enable a user to run unrestricted82 # commands via sudo.83 #84 # Defaults   env_keep += "HOME"85 86 Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin87 88 ## Next comes the main part: which users can run what software on 89 ## which machines (the sudoers file can be shared between multiple90 ## systems).91 ## Syntax: //语法92 ##93 ##      user    MACHINE=COMMANDS //用户 登录的主机=（可以变换的身份） 可以执行的命令94 ##95 ## The COMMANDS section may have other options added to it. //命令部分可以附带一些其他选项96 ##97 ## Allow root to run any commands anywhere 98 root    ALL=(ALL)       ALL   99 redhat  ALL=(ALL)       ALL   //可以使用最高权限 需要输入用户密码
100 ## Allows members of the 'sys' group to run networking, software,
101 ## service management apps and more.
102 # %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
103
104 ## Allows people in group wheel to run all commands //允许wheel用户组中的用户执行所有命令
105 %wheel  ALL=(ALL)       ALL
106
107 ## Same thing without a password
108 # %wheel        ALL=(ALL)       NOPASSWD: ALL  //允许wheel用户组中的用户不输入密码情况下使用所有命
109
110 ## Allows members of the users group to mount and unmount the
111 ## cdrom as root
112 # %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
113
114 ## Allows members of the users group to shutdown this system
115 # %users  localhost=/sbin/shutdown -h now //允许普通用户shutdown
116
117 ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
118 #includedir /etc/sudoers.d