- Umsebenzisi wempande unokulawula okugcwele ohlelweni, okuvumela izinguquko ezibalulekile ezingalimaza ukuzinza kwemishini.
- Ukusebenzisa i-sudo kuyindlela ephephe kakhulu yokusebenzisa imisebenzi yokuphatha ngaphandle kwesidingo sokungena ngemvume njengomsebenzisi omkhulu.
- Kunezingozi ezinkulu zokusebenza njengempande, njengokususa amafayela abalulekile ngengozi noma ukuba sengozini ye-malware enamalungelo aphelele.
- Ukucushwa kwe-granular kwama-sudoers kuvumela izimvume ezithile ukuthi zidluliselwe kubasebenzisi abathile, okuthuthukisa ukulandelelwa kanye nokuphepha.
Uma singena ezweni le-Linux, akunakwenzeka ukuhlangana nomfanekiso womsebenzisi oyinhloko. Empeleni, lo msebenzisi ungumnikazi nomphathi wesistimu , i-akhawunti enamalungelo aphelele angenza noma yini ayifunayo, ngaphandle kwemingcele yemvume yokuyimisa. Ilingana nomphathi we-Windows, yize ku-Linux, amandla ajule kakhulu futhi aqondile, okwenza kube ithuluzi elimangalisayo kodwa futhi inkemba esika nhlangothi zombili uma singazi ukuthi siyisebenzisa kanjani.
Kwabaningi bethu, impilo yansuku zonke ichithwa njengomsebenzisi ojwayelekile, inqunyelwe ukuvimbela iphutha lokunganaki ekusuleni ingxenye yesistimu yokusebenza. Kodwa-ke, eminye imisebenzi igcinelwe i-root kuphela , njengokufaka izinhlelo eziyinkimbinkimbi noma ukuguqula amafayela okucushwa abucayi. Yilapho ukusebenzisana phakathi kwe-`sudo` ne-`su` kuqala khona ukusebenza, amathuluzi asivumela ukuthi sandise amalungelo kuphela lapho kudingeka kakhulu, okusivimbela ekushiyeni umnyango uvulekele izinhlekelele zokusebenza noma ukuhlaselwa kwangaphandle.
Uyini ngempela umsebenzisi wempande?
I-root superuser yi-akhawunti ene -ID yomsebenzisi (UID) 0. Nakuba umsebenzisi ojwayelekile enemikhawulo yokuvikela i-kernel yesistimu, i-root ingafunda, ibhale, futhi isebenzise noma yiliphi ifayela kudiski. Lokhu kufaka phakathi ukuphatha ama-akhawunti abanye abasebenzisi, ukuguqula i-kernel , noma ukususa wonke ama-partitions ngaphandle kwemvume yesistimu.
Ekusabalalisweni okufana no-Ubuntu, kuye kwamukelwa ifilosofi yokuphepha lapho i-akhawunti yempande ingavunyelwe ngokuzenzakalelayo ukuze ungene ngemvume ngqo. Lokhu akusho ukuthi i-root ayikho, kodwa kunalokho ukuthi ayinayo iphasiwedi eyabelwe ukuze kungabikho muntu ongangena ngemvume ngqo, okuphoqa umphathi ukuthi asebenzise izindlela ezilawulwa kakhulu ukuze aphakamise amalungelo akhe.
I-Sudo vs. Su: Uyini umehluko wangempela?
Bavame ukudideka, kodwa basebenza ngendlela ehlukile. Umyalo othi `sudo` (superuser do) ufana nokucela ilungelo elilodwa. Ukuvumela ukuthi usebenzise umyalo othize onamalungelo ezimpande, kodwa uhlala ungumsebenzisi ojwayelekile. Uhlelo luzocela iphasiwedi yakho ukuqinisekisa ubuwena bakho, futhi uma isenzo sesiqediwe, ubuyela emalungelweni akho avamile. Ukuze uthole ulwazi olwengeziwe, ungabheka umhlahlandlela wethu ophelele wokuphakamisa amalungelo nge-`sudo`.
Ngakolunye uhlangothi, umyalo wakho (umsebenzisi othatha indawo) Isetshenziselwa ukushintsha ngokuphelele ubuwena bakho. Uma uyisebenzisa ngaphandle kwezimpikiswano noma su -Uhlelo luzokubuza ukuthi iphasiwedi yomsebenzisi wezimpande ukuze kube yiso sonke isikhathi se-terminal. Kulula kakhulu uma kufanele wenze izinguquko ezingamashumi amabili zilandelana, kodwa kunjalo ingozi kakhulu ngoba noma yiliphi iphutha olenzayo ngenkathi isixwayiso sibonisa uphawu # lizokwenziwa ngokungenasihawu.
Izingozi zokudlala uNkulunkulu ku-Linux
Ukusebenza njengempande ngaphandle kokuqonda okuqinile ngalokho okwenzayo kuyindlela yokuthola inhlekelele. Ingozi esobala kakhulu... ukususwa ngengozi kwesistimu yamafayelaIphutha elivamile ukugijima rm -rf /okuyinto etshela ikhompyutha ukuthi isuse konke kusukela ezimpandeni kuya phansi. Ngisho nesikhala esingekho endaweni eguquguqukayo yendlela singabangela lokhu. ukubhubhisa idatha ebalulekile ngemizuzwana.
Elinye iphuzu elibalulekile ukuphepha kwesofthiwe yangaphandle. Ukusebenzisa izikripthi ezilandiwe kusuka ku-inthanethi ngamalungelo ezimpande empeleni ukunikeza okhiye bendlu yakho kumuntu ongamazi . Uma iskripthi siqukethe i-rootkit noma i-malware, umhlaseli uzoba nokulawula okuphelele phezu kwehadiwe nesofthiwe, okungenzeka adale iminyango yangemuva engabonakali ezingeni le-kernel okungenakwenzeka ukuyibona. Ngakho-ke, kubalulekile ukufunda izincwadi zokuphepha kwekhompyutha ukuze uvikele uhlelo lwakho.
Okokugcina, akumelwe sikhohlwe ukulahleka kokulandelekaUma usebenzisa i-sudo, uhlelo lugcina ukungena ngemvume /var/log/auth.log okubonisa ukuthi ubani owenze ini nokuthi nini. Kodwa uma ungena ngqo njengempande, zonke izenzo zilogwa nje ngokuthi "impande". Endaweni enabaphathi abaningi, lokhu kwenza kube Akunakwenzeka ukwazi ukuthi ubani ophule uhlelo, okwenza kube nzima kakhulu ukuhlolwa kwamabhuku kanye nokulungiswa kwamaphutha.
Indlela yokuphatha ngokuphephile i-akhawunti yempande
Uma ngesizathu esithile udinga ukusebenzisa i-akhawunti yempande, ungayinika iphasiwedi ngomyalo sudo passwd rootKodwa-ke, isincomo esijwayelekile sithi gcina kukhiyiwe ngokusebenzisa sudo passwd -l rootLokhu kuvimbela othile ukuthi azame ukungena ngenkani kwi-akhawunti enamandla kakhulu kuseva, ikakhulukazi uma une-SSH access evuliwe.
Uma sikhuluma nge-SSH, kuvumela i- ukungena ngemvume okuqondile kwempande en /etc/ssh/sshd_config Lokhu kuyingozi enkulu. Okungcono kakhulu, kufanele ungene ngemvume nge-akhawunti yakho evamile yomsebenzisi bese wandisa amalungelo. Uma usanquma ukuyivumela, kubalulekile ukuyisebenzisa Ukuqinisekiswa okusekelwe kukhiye we-SSH esikhundleni samaphasiwedi alula, ukuvimbela ama-robot azenzakalelayo ukuthi angaqageli iphasiwedi yakho ngemizuzu embalwa.
Ukwazi kahle izinhlelo zefayela le-sudoers kanye ne-visudo
Ukuze sisebenze kahle ekuphatheni, singalungisa ifayela /etc/sudoersUngalokothi uhlele leli fayela ngomhleli ojwayelekile; sebenzisa njalo umyalo we-visudoIsizathu silula: i-visudo ihlola amaphutha e-syntax ngaphambi kokulondoloza izinguquko. Uma wephula ifayela le-sudoers ngephutha lokuthayipha, ungakwenza ukushiywa ngaphandle ohlelweni lwakho ngaphandle kokusebenzisa i-sudo.
Ngaphakathi kwaleli fayela, singakha izibizo zabasebenzisi kanye nemiyalo ukuze ziqonde kakhudlwana. Isici esiwusizo kakhulu yithegi ye -NOPASSWD , evumela umsebenzisi ukuthi asebenzise imiyalo ethile (njengokuqala kabusha ikhompyutha noma ukubuyekeza isevisi) ngaphandle kokucelwa iphasiwedi yakhe . Lokhu kulungele ukwenza okuzenzakalelayo noma abasebenzisi abadinga kuphela ukwenza imisebenzi ethile ngaphandle kokulawula ikhompyutha ngokugcwele.
Amathiphu ephasiwedi kanye nokutakula kabusha
Ngezinye izikhathi silahlekelwa ukufinyelela noma sikhohlwe iphasiwedi eyinhloko. Kulezo zimo, i-Linux isenza sikwazi Setha kabusha iphasiwedi kusuka ku-GRUBUkufinyelela iModi Yokubuyisela Nokufaka Idrayivu Ngemvume Yokubhala Usebenzisa mount -o rw, remount /, singawuqalisa umyalo passwd root bese usetha iphasiwedi entsha kusuka ku-superuser console. Ezimweni ezibucayi kakhulu, amathuluzi afana I-SystemRescue Zingaba uhlelo lokutakula oluphelele lokubuyisa ukulawula.
Enye inketho ukusebenzisa i-a Ubuntu LiveCDUma sesiqalise uhlelo kusuka ku-USB, singabeka ingxenye ye-hard drive ohlelweni lwefayela lesikhashana sisebenzisa umyalo chroot "ukufaka" ukufakwa kwediski bese ushintsha iphasiwedi yempande kusuka lapho. Kuyinqubo yobuchwepheshe kancane, kodwa ngempumelelo ngokwedlulele uma uhlelo lungaqali noma ukufinyelela kuvinjiwe.
Ukugcina imikhuba emihle yokuphatha i-Linux kuhilela ukusebenzisa njalo isimiso se-least privilege : ungasebenzisi i-root uma i-sudo yanele, phuma ku-superuser shell ngokushesha nje lapho uqeda umsebenzi wakho, futhi uhlale uqaphele noma yisiphi iskripthi esicela ukusebenza ngamalungelo aphezulu. Ekugcineni, isihluthulelo ukukhawulela ukuvezwa kwe-superuser ukuze iphutha elincane lomuntu lingaholeli ekufakweni kabusha kwesistimu yokusebenza okuphelele.
