创建用户#
useradd -m wangsd-read
passwd wangsd-read
(w******9)
ACL 授权#
yum install acl -y
setfacl -R -m u:wangsd-read:rX /data
setfacl -R -d -m u:wangsd-read:rX /data
只读用户权限扩展(只读命令的sudo白名单)#
- 确认主配置会加载这个目录
grep -Rin 'includedir' /etc/sudoers - 确认命令实际路径(输出里的路径替换进下面的配置)
which du find lsof journalctl lsblk fdisk df ls - 创建配置文件
echo 'Cmnd_Alias READONLY_DISK = /usr/bin/du, /usr/bin/find, /usr/sbin/lsof, /usr/bin/journalctl, /usr/bin/lsblk, /usr/sbin/fdisk, /usr/bin/df, /usr/bin/ls' > /etc/sudoers.d/wangsd-readecho 'wangsd-read ALL=(root) NOPASSWD: READONLY_DISK' >> /etc/sudoers.d/wangsd-read- 授权与核验
chmod 440 /etc/sudoers.d/wangsd-read
visudo -c
WindowsPowerShell创建ssh连接#
Get-Content C:\Users\sidek\.ssh\id_ed25519.pub | ssh -p 22 wangsd-read@110.41.12.11 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"- 配置ssh config
Host whisglintHostName 36.151.142.165User wangsd-readIdentityFile C:\Users\sidek\.ssh\id_ed25519-
SSH 公钥认证所需的目录和文件权限
chown -R wangsd-read:wangsd-read /home/wangsd-read/.ssh
chmod 700 /home/wangsd-read/.ssh
chmod 600 /home/wangsd-read/.ssh/authorized_keys -
追加docker环境访问权限
echo 'Cmnd_Alias READONLY_DOCKER = /usr/bin/docker system df, /usr/bin/docker system df *, /usr/bin/docker ps, /usr/bin/docker ps *, /usr/bin/docker images, /usr/bin/docker image ls *, /usr/bin/docker stats --no-stream' >> /etc/sudoers.d/wangsd-readecho 'wangsd-read ALL=(root) NOPASSWD: READONLY_DOCKER' >> /etc/sudoers.d/wangsd-read查看当前服务器操作系统#
cat /etc/os-release