Copyright © 2004-2010 Jo HoSeok. All rights reserved.
root@wl ~/test # vi file1 FILE1 root@wl ~/test # ls -l 1) -rw-r--r-- 1 root other 6 3월 19일 16:17 file1 root@wl ~/test # getfacl file1 2) # file: file1 # owner: root # group: other user::rw- group::r-- #effective:r-- mask:r-- other:r-- root@wl ~/test # chmod 440 file1 3) root@wl ~/test # ls -l -r--r----- 1 root other 6 3월 19일 16:17 file1 root@wl ~/test # setfacl -m u:windy:r-- file1 4) root@wl ~/test # ls -l 5) -r--r-----+ 1 root other 6 3월 19일 16:17 file1 root@wl ~/test # getfacl file1 6) # file: file1 # owner: root # group: other user::r-- user:windy:r-- #effective:r-- group::r-- #effective:r-- mask:r-- other:--- root@wl ~/test # setfacl -d u:windy:r-- file1 7) root@wl ~/test # vi file2 FILE2 root@wl ~/test # getfacl file1 | setfacl -f - file2 8)1) file1을 생성하고 권한을 확인한다. root:other/644 권한이다. 이 상태에서 windy사용자는 이 파일을 읽을 수 있다.
root@wl ~/test # getfacl file1 File system doesn't support aclent_t style ACL's. See acl(5) for more information on Solaris ACL support. root@wl ~/test #ZFS가 도입되면서 ACL이 변경되었다. 솔라리스의 ACL은 POSIX 기반이지만, ZFS에서의 ACL은 오히려 NFSv4의 ACL과 유사하다. NT와도 비슷한 방법이다. ZFS의 ACL은 chmod 명령을 이용해 설정한다. 자세한 내용은 Solaris ZFS Administration Guide - Chapter 8 Using ACLs to Protect ZFS Files을 참조한다.
root@wl ~ # cat file1
TEST
root@wl ~ # ls -v file1
-rw-r--r-- 1 root root 5 5월 18일 18:21 file1
0:owner@:execute:deny
1:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
2:group@:write_data/append_data/execute:deny
3:group@:read_data:allow
4:everyone@:write_data/append_data/write_xattr/execute/write_attributes
/write_acl/write_owner:deny
5:everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize
:allow
windy@wl ~ $ cat file1
TEST
root@wl ~ # chmod 600 file1
root@wl ~ # ls -v file1
-rw------- 1 root root 5 5월 18일 18:21 file1
0:owner@:execute:deny
1:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
2:group@:read_data/write_data/append_data/execute:deny
3:group@::allow
4:everyone@:read_data/write_data/append_data/write_xattr/execute
/write_attributes/write_acl/write_owner:deny
5:everyone@:read_xattr/read_attributes/read_acl/synchronize:allow
windy@wl ~ $ cat file1
cat: file1을(를) 열 수 없습니다
root@wl ~ # chmod A+user:windy:read_data/write_data/execute:allow file1
root@wl ~ # ls -v file1
-rw-------+ 1 root root 5 5월 18일 18:21 file1
0:user:windy:read_data/write_data/execute:allow
1:owner@:execute:deny
2:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
3:group@:read_data/write_data/append_data/execute:deny
4:group@::allow
5:everyone@:read_data/write_data/append_data/write_xattr/execute
/write_attributes/write_acl/write_owner:deny
6:everyone@:read_xattr/read_attributes/read_acl/synchronize:allow
windy@wl ~ $ cat file1
TEST
root@wl ~ # chmod A0- file1
root@wl ~ # ls -v file1
-rw------- 1 root root 5 5월 18일 18:21 file1
0:owner@:execute:deny
1:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
2:group@:read_data/write_data/append_data/execute:deny
3:group@::allow
4:everyone@:read_data/write_data/append_data/write_xattr/execute
/write_attributes/write_acl/write_owner:deny
5:everyone@:read_xattr/read_attributes/read_acl/synchronize:allow
windy@wl ~ $ cat file1
cat: file1을(를) 열 수 없습니다
root@wl ~ # wget ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p15.tar.gz root@wl ~ # tar xvfz sudo-1.6.9p15.tar.gz root@wl ~ # cd sudo-1.6.9p15 root@wl ~/sudo-1.6.9p15 # ./configure root@wl ~/sudo-1.6.9p15 # make root@wl ~/sudo-1.6.9p15 # make install
root@wl ~ # vi /etc/sudoers 1) root ALL=(ALL) ALL admin ALL=/usr/local/apache2/bin/apachectl root@wl ~ # su - admin 2) admin@wl ~ $ sudo -l 3) Password:admin사용자의 패스워드를 입력한다 User admin may run the following commands on this host: (root) /usr/local/apache2/bin/apachectl admin@wl ~ $ sudo /usr/local/apache2/bin/apachectl restart We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. Password:admin사용자의 패스워드를 입력한다 admin@wl ~ $ man -M /usr/local/man sudoers 4)1) sudoers 파일을 수정한다.
root@wl ~ # vi /etc/security/exec_attr 1) Apache Management:suser:cmd:::/usr/local/apache2/bin/apachectl:uid=0 root@wl ~ # vi /etc/security/prof_attr 2) Apache Management:::Manage the Apache web server: root@wl ~ # cat /etc/security/auth_attr 3) root@wl ~ # roleadd -d /export/home/rapache -u 400 -m -P "Apache Management" rapache 4) root@wl ~ # passwd rapache 새 암호: 새 암호를 다시 입력하십시오: passwd: 암호(rapache용)가 성공적으로 변경되었습니다. root@wl ~ # cat /etc/passwd rapache:x:400:1::/export/home/rapache:/bin/pfsh root@wl ~ # cat /etc/user_attr rapache::::type=role;profiles=Apache Management root@wl ~ # usermod -R rapache admin 5) root@wl ~ # cat /etc/user_attr admin::::type=normal;roles=rapache root@wl ~ # su - rapache 6) $ id uid=400(rapache) gid=1(other) # /usr/local/apache2/bin/apachectl start 7) # exit # su - admin 8) $ id uid=111(admin) gid=10(staff) $ su - rapache Password: $ id uid=400(rapache) gid=1(other) $ /usr/local/apache2/bin/apachectl start root@wl ~ # su - windy 9) windy@wl ~ $ su - rapache Password: Roles can only be assumed by authorized users su: 잘못되었습니다 windy@wl ~ $1) exec_attr 파일을 수정한다. "Apache Management"라는 프로파일에 대한 실행커맨드/권한에 대한 내용이다.
|
|
Copyright © 2004-2010 Jo HoSeok. All rights reserved. |