fedora-docs-l10n/fedora-system-administrat/f31/pages/basic-system-configuration/Gaining_Privileges

Zen

	English	French	Actions
	In the above example, _command_ would be replaced by a command normally reserved for the `root` user, such as [command]#mount#.
	The [command]#sudo# command allows for a high degree of flexibility. For instance, only users listed in the `/etc/sudoers` configuration file are allowed to use the [command]#sudo# command and the command is executed in the user's shell, not a `root` shell. This means the `root` shell can be completely disabled as shown in the link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/++[Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}7 Security Guide].
	Each successful authentication using the [command]#sudo# command is logged to the file `/var/log/messages` and the command issued along with the issuer's user name is logged to the file `/var/log/secure`. If additional logging is required, use the `pam_tty_audit` module to enable TTY auditing for specified users by adding the following line to your `/etc/pam.d/system-auth` file:
	session required pam_tty_audit.so disable=pass:quotes[_pattern_] enable=pass:quotes[_pattern_]
	where _pattern_ represents a comma-separated listing of users with an optional use of globs. For example, the following configuration will enable TTY auditing for the `root` user and disable it for all other users:
	session required pam_tty_audit.so disable=* enable=root
	Another advantage of the [command]#sudo# command is that an administrator can allow different users access to specific commands based on their needs.
	Administrators wanting to edit the [command]#sudo# configuration file, `/etc/sudoers`, should use the [command]#visudo# command.
	To give someone full administrative privileges, type [command]#visudo# and add a line similar to the following in the user privilege specification section:
	juan ALL=(ALL) ALL
	This example states that the user, `juan`, can use [command]#sudo# from any host and execute any command.
	The example below illustrates the granularity possible when configuring [command]#sudo#:
	%users localhost=/sbin/shutdown -h now
	This example states that any member of the `users` system group can issue the command [command]#/sbin/shutdown -h now# as long as it is issued from the console.
	The man page for `sudoers` has a detailed listing of options for this file.
	Important	Important
	There are several potential risks to keep in mind when using the [command]#sudo# command. You can avoid them by editing the `/etc/sudoers` configuration file using [command]#visudo# as described above. Leaving the `/etc/sudoers` file in its default state gives every user in the `wheel` group unlimited `root` access.
	By default, [command]#sudo# stores the sudoer's password for a five minute timeout period. Any subsequent uses of the command during this period will not prompt the user for a password. This could be exploited by an attacker if the user leaves their workstation unattended and unlocked while still being logged in. This behavior can be changed by adding the following line to the `/etc/sudoers` file:
	Defaults timestamp_timeout=pass:quotes[_value_]
	where _value_ is the desired timeout length in minutes. Setting the _value_ to 0 causes [command]#sudo# to require a password every time.
	If a sudoer's account is compromised, an attacker can use [command]#sudo# to open a new shell with administrative privileges:
	[command]#sudo /bin/bash#
	Opening a new shell as `root` in this or similar fashion gives the attacker administrative access for a theoretically unlimited amount of time, bypassing the timeout period specified in the `/etc/sudoers` file and never requiring the attacker to input a password for [command]#sudo# again until the newly opened session is closed.
	Additional Resources	Ressources supplémentaires
	While programs allowing users to gain administrative privileges are a potential security risk, security itself is beyond the scope of this particular book. You should therefore refer to the resources listed below for more information regarding security and privileged access.
	Installed Documentation
	`su`(1) — The manual page for [command]#su# provides information regarding the options available with this command.
	`sudo`(8) — The manual page for [command]#sudo# includes a detailed description of this command and lists options available for customizing its behavior.
	`pam`(8) — The manual page describing the use of Pluggable Authentication Modules (PAM) for Linux.
	Online Documentation	Documentation en ligne
	The link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/++[Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}7 Security Guide] provides a more in-depth look at potential security issues pertaining to setuid programs as well as techniques used to alleviate these risks.

Loading…

None

Suggestion removed during cleanup

English

French 9 characters edited Current translation

3 years ago

julroy67

Suggestion accepted

English

French 9 characters edited Current translation

3 years ago

None

Suggestion added

English

French 9 characters edited Current translation

3 years ago

Browse all string changes

Things to check

Unchanged translation

Source and translation are identical

Reset

Glossary

English	French
No related strings found in the glossary.

String information

Source string description

type: Block title

Flags

no-wrap

Source string location

pages/basic-system-configuration/Gaining_Privileges.adoc:112

String age

4 years ago

Last updated

10 months ago

Source string age

4 years ago

Translation file

po/fr/f31/pages/basic-system-configuration/Gaining_Privileges.po, string 41