获取超级用户访问权限
Root用户：
在redhat7.2中root用户特权高于文件系统上的一般特权，用于管理系统，要执行诸如安装或删除软件以及管理系统文件和目录等任务时，必须将特权升级到root用户。
大多数设备都受root用户控制，但也有些设备并非如此。例如：USB移动设备就可以受一般用户控制，默认情况下只有root用户可以管理“固定”磁盘。
Linux上的root账户大致相当于windows上本地的admin账户。在linux系统中大多数管理员登录到非特权账户（root），然后使用各种工具（su，sudo，polickit）获得root权限。
利用su切换账户：
SU命令：
切换用户，未指定用户名即切换到root用户，当普通用户调用root用户时需要输入root用户密码。SU - ：切换用户后切换工作目录，环境设置为以该用户登录完全一致，而su 仅以该用户身份使用当前的环境设置启动shell。
su -c : 该命令作用等同与windows里的runas一样，能够用另一个用户身份执行任意程序。
su 缺陷：普通用户使用使用时需要输入root用户密码。
sudo命令:
可以使用户根据/etc/sudoers 文件中的设置，而被允许以root或其他用户身份运行命令。sudo 要求用户输入自己的密码进行身份验证，而不是输入root用户密码。这样可以让管理员将细微的权限用户来委派系统管理任务，而无需root用户密码。
例如：如果sudo 已配置为允许redhat用户root身份运行usermod命令，那么redhat就可以运行一下命令锁定用户账户。
sudo都提供了一个编辑该文件的命令：visudo来对该文件进行修改，出现配置错误会有提示，使用方法同vim类似。
/etc/sudoers文件详解
1 ## Sudoers allows particular users to run various commands as
2 ## the root user, without needing the root password.
3 ## //无需root用户密码执行各种只有root用户才可以执行的命令
4 ## Examples are provided at the bottom of the file for collections
5 ## of related commands, which can then be delegated out to particular
6 ## users or groups. //用户所用组
7 ##
8 ## This file must be edited with the 'visudo' command.
9
10 ## Host Aliases
11 ## Groups of machines. You may prefer to use hostnames (perhaps using
12 ## wildcards for entire domains) or IP addresses instead.
13 # Host_Alias FILESERVERS = fs1, fs2
14 # Host_Alias MAILSERVERS = smtp, smtp2
15
16 ## User Aliases
17 ## These aren't often necessary, as you can use regular groups
18 ## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
19 ## rather than USERALIAS
20 # User_Alias ADMINS = jsmith, mikem
21
22
23 # Command Aliases
24 ## These are groups of related commands...
25
26 ## Networking //网络操作相关命令别名
27 # Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
28
29 ## Installation and management of software
30 # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
31
32 ## Services //服务器相关命令别名
34
35 ## Updating the locate database //本地数据库升级命令别名
36 # Cmnd_Alias LOCATE = /usr/bin/updatedb
37
38 ## Storage
39 # Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount //磁盘操作命令别名
40
41 ## Delegating permissions //代理权限相关别名
42 # Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
43
44 ## Processes
45 # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
46
47 ## Drivers //进程相关命令别名
48 # Cmnd_Alias DRIVERS = /sbin/modprobe
49
50 # Defaults specification
51
52 #
53 # Disable "ssh hostname sudo <cmd>", because it will show the password in clear.
54 # You have to run "ssh -t hostname sudo <cmd>".
55 #
56 Defaults requiretty
57
58 #
59 # Refuse to run if unable to disable echo on the tty. This setting should also be
60 # changed in order to be able to use sudo without a tty. See requiretty above.
61 #
62 Defaults !visiblepw
63
64 #
65 # Preserving HOME has security implications since many programs
66 # use it when searching for configuration files. Note that HOME
67 # is already set when the the env_reset option is enabled, so
68 # this option is only effective for configurations where either
69 # env_reset is disabled or HOME is present in the env_keep list.
70 #
71 Defaults always_set_home
72
73 Defaults env_reset
74 Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
75 Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
76 Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
77 Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
78 Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
79
80 #
81 # Adding HOME to env_keep may enable a user to run unrestricted
82 # commands via sudo.
83 #
84 # Defaults env_keep += "HOME"
85
86 Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin
87
88 ## Next comes the main part: which users can run what software on
89 ## which machines (the sudoers file can be shared between multiple
90 ## systems).
91 ## Syntax:
92 ##
93 ## user MACHINE=COMMANDS
94 ##
95 ## The COMMANDS section may have other options added to it.
80 #
81 # Adding HOME to env_keep may enable a user to run unrestricted
82 # commands via sudo.
83 #
84 # Defaults env_keep += "HOME"
85
86 Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin
87
88 ## Next comes the main part: which users can run what software on
89 ## which machines (the sudoers file can be shared between multiple
90 ## systems).
91 ## Syntax: //语法
92 ##
93 ## user MACHINE=COMMANDS //用户 登录的主机=（可以变换的身份） 可以执行的命令
94 ##
95 ## The COMMANDS section may have other options added to it. //命令部分可以附带一些其他选项
96 ##
97 ## Allow root to run any commands anywhere
98 root ALL=(ALL) ALL
99 redhat ALL=(ALL) ALL //可以使用最高权限 需要输入用户密码
100 ## Allows members of the 'sys' group to run networking, software,
101 ## service management apps and more.
102 # %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
103
104 ## Allows people in group wheel to run all commands //允许wheel用户组中的用户执行所有命令
105 %wheel ALL=(ALL) ALL
106
107 ## Same thing without a password
108 # %wheel ALL=(ALL) NOPASSWD: ALL //允许wheel用户组中的用户不输入密码情况下使用所有命
109
110 ## Allows members of the users group to mount and unmount the
111 ## cdrom as root
112 # %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
113
114 ## Allows members of the users group to shutdown this system
115 # %users localhost=/sbin/shutdown -h now //允许普通用户shutdown
116
117 ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
118 #includedir /etc/sudoers.d