su, sudo, gksudo, bash startup files.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## SU\n",
    "\n",
    "Giving away root password to anyone"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "su "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "echo $USER"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "as login shell:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "su - # same as -l or --login"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "use different shell:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/bin/sh\n",
      "/bin/dash\n",
      "/bin/bash\n",
      "/bin/rbash\n"
     ]
    }
   ],
   "source": [
    "cat /etc/shells"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "rbash (1)            - restricted bash, see bash(1)\n"
     ]
    }
   ],
   "source": [
    "whatis rbash"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "su -s /bin/sh # --shell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "su -l milad"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Bash config aka startup files.\n",
    "`/etc/profile\n",
    "/etc/bash.bashrc`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      ".bash_logout  .bashrc  .profile\n"
     ]
    }
   ],
   "source": [
    "ls -A /etc/skel"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### As a login shell\n",
    "When bash is invoked as an interactive login shell, or as a non-interactive shell with the --login option, it first reads and executes commands from the file `/etc/profile`, if that file exists. After reading that file, it looks for `~/.bash_profile`, `~/.bash_login`, and `~/.profile`, in that order, and reads and exe‐cutes commands from the first one that exists and is readable. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "~/.bash_profile > ~/.bash_login > ~/.profile\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### As an interactive shell\n",
    "When an interactive shell that is not a login shell is started, bash reads and executes commands from `/etc/bash.bashrc` and `~/.bashrc`, if these files exist.\n",
    "\n",
    "`/etc/bash.bashrc > ~/.bashrc`\n",
    "\n",
    "#### While closing a login shell\n",
    "When a login shell exits, bash reads and executes commands from the file ~/.bash_logout, if it exists."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "And after all `~/.bashrc` will sources `~/.bash_aliases` if it exists."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "\n",
      "if [ -n \"$BASH_VERSION\" ]; then\n",
      "    # include .bashrc if it exists\n",
      "    if [ -f \"$HOME/.bashrc\" ]; then\n",
      "\t. \"$HOME/.bashrc\"\n",
      "    fi\n",
      "fi\n",
      "\n",
      "PATH=\"$HOME/Bin:$HOME/.local/bin:$PATH\"\n",
      "\n"
     ]
    }
   ],
   "source": [
    "grep -v '^#' ~/.profile"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## sudo"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "milad adm cdrom sudo dip plugdev lpadmin sambashare wireshark docker\n"
     ]
    }
   ],
   "source": [
    "id -Gn"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "adm cdrom sudo dip plugdev milad lpadmin sambashare wireshark docker "
     ]
    }
   ],
   "source": [
    "grep milad /etc/group | cut -f1 -d: | tr '\\n' ' '"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0\n",
      "root\n"
     ]
    }
   ],
   "source": [
    "id root -G; id root -Gn"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "cat: /etc/sudoers: Permission denied\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "cat /etc/sudoers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo cat /etc/sudoers"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "    # Resets the terminal environment after switching to root. So, ie: all user set variables are removed\n",
    "    # commands to be executed with a new, minimal environment.\n",
    "    Defaults\t    env_reset\n",
    "\n",
    "    # Send mail to the mailto user if the user running sudo does not enter the correct password.\n",
    "    Defaults\t    mail_badpass\n",
    "\n",
    "    Defaults        insults\n",
    "\n",
    "    # User privilege specification\n",
    "    # lets root do everything on any machine as any user.\n",
    "    root\t ALL=(ALL:ALL) ALL\n",
    "\n",
    "    # Members of the admin group may gain root privileges\n",
    "    # Anybody in the admin group run anything as any user\n",
    "    %admin   ALL=(ALL) ALL\n",
    "\n",
    "    # Allow members of group sudo to execute any command\n",
    "    %sudo\t ALL=(ALL:ALL) ALL"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Who can run what as who\n",
    "\n",
    "`who host=(user:group) options:commands`\n",
    "\n",
    "`<user list> <host list> = (<operator list>) <tag list>: <command list>`\n",
    "\n",
    "- host: sharing asudoers file (ALL/Name)\n",
    "- user: -u\n",
    "- group: -g\n",
    "- options: tags (NOEXEC, NOPASSWD, PASSWD, etc)\n",
    "\n",
    "- - -\n",
    "\n",
    "Bellow line would allow the user ray to run /bin/kill, /bin/ls, and /usr/bin/lprm as root on the machine rushmore without authenticating himself. \n",
    "\n",
    "    ray     rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm\n",
    "\n",
    "If we only want ray to be able to run /bin/kill without a password the entry would be:\n",
    "\n",
    "    ray     rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm\n",
    "\n",
    "What does this line do?  \n",
    "\n",
    "    %wheel   ALL=(ALL) NOPASSWD: ALL"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "EDITOR=nano sudo visudo"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Aliases\n",
    "\n",
    "User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias.\n",
    "\n",
    "There are also built in aliases called ALL which match everything where they are used."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### User Aliases\n",
    "     # Everybody in the \"admin\" group\n",
    "     User_Alias ADMINS = %admin\n",
    "     \n",
    "     # Only specified users\n",
    "     User_Alias LADMINS = milad, rajab, jafar\n",
    "     \n",
    "     # Everyone in ADMINS alias except the ones are in LADMINS\n",
    "     User_Alias GUSERS = ADMINS, !LADMINS\n",
    "     \n",
    "#### Host Aliases\n",
    "\n",
    "     Host_Alias SRV = 192.168.56.10, 192.168.56.14, debian-dns\n",
    "     Host_Alias SRVS = 192.168.56.0/255.255.255.0\n",
    "\n",
    "#### Cmnd Aliases\n",
    "     Cmnd_Alias SHUTDOWN_CMDS = /sbin/poweroff, /sbin/reboot, /sbin/halt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Change user (switch to)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo -i -u milad # Close to `su -`; login shell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo -u milad -i /bin/dash # specify shell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo -s -u milad # non-login shell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo -u milad -s /bin/dash # specify"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "collapsed": true
   },
   "source": [
    "#### gksudo, gksu\n",
    "\n",
    "gksu  is  a  frontend  to su and gksudo is a frontend to sudo.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "gksudo thunar # asks for my password"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "gksu thunar # root pass - defaults to use \"sudo mode\" root is disabled right?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "lrwxrwxrwx 1 root root 4 Dec 25  2014 \u001b[0m\u001b[01;36m/usr/bin/gksudo\u001b[0m -> \u001b[01;32mgksu\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "ls -l `which gksudo` "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "gksu --su-mode gufw"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "gksu -u milad thunar"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "sudo -H thunar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- - -\n",
    "#### References\n",
    "\n",
    "man page of `sudo`, `su`. `gksudo`\n",
    "\n",
    "https://help.ubuntu.com/community/Sudoers  "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- - -\n",
    "## Lecture notes\n",
    "\n",
    "- All lecture notes are available at github in `ipynb` format: [https://github.com/ravexina/linux-notes](https://github.com/ravexina/linux-notes). \n",
    "\n",
    "\n",
    "- There are `html` exports of project available at: [https://ravexina.github.io/linux-notes](https://ravexina.github.io/linux-notes).\n",
    "- - -\n",
    "\n",
    "## License\n",
    "<a rel=\"license\" href=\"http://creativecommons.org/licenses/by-nc-sa/4.0/\">\n",
    "<img alt=\"Creative Commons License\" style=\"border-width:0\" src=\"https://i.creativecommons.org/l/by-nc-sa/4.0/88x31.png\" />\n",
    "</a>\n",
    "\n",
    "<span property=\"dct:title\">Linux Notes</span> by \n",
    "<a href=\"http://github.com/ravexina/Linux-Notes\" property=\"cc:attributionName\" rel=\"cc:attributionURL\">Milad As (Ravexina)</a> is licensed under a <a rel=\"license\" href=\"http://creativecommons.org/licenses/by-nc-sa/4.0/\">Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License</a>.\n",
    "\n",
    "- - -\n",
    "\n",
    "<a rel=\"license\" href=\"https://gitlab.com/ravexina/\"><img alt=\"ravexina's gitlab\" style=\"display:inline;border-width:0;height:30px;float:left;\" src=\"img/logo/logo-square.png\" /></a> \n",
    "\n",
    "<a rel=\"license\" href=\"https://github.com/ravexina/\"><img alt=\"ravexina's github\" style=\"float:right;display:inline;border-width:0;height:30px;\" src=\"img/logo/GitHub_Logo.png\" /></a>"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}