108 lines
5.7 KiB
HTML
108 lines
5.7 KiB
HTML
<!DOCTYPE html>
|
||
<html>
|
||
<head>
|
||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
<title>iRedMail Easy: Setup sudo for deployment</title>
|
||
<link rel="stylesheet" type="text/css" href="./css/markdown.css" />
|
||
</head>
|
||
<body>
|
||
|
||
<div id="navigation">
|
||
<a href="https://www.iredmail.org" target="_blank">
|
||
<img alt="iRedMail web site"
|
||
src="./images/logo-iredmail.png"
|
||
style="vertical-align: middle; height: 30px;"
|
||
/>
|
||
<span>iRedMail</span>
|
||
</a>
|
||
// <a href="./index.html">Document Index</a></div><h1 id="iredmail-easy-setup-sudo-for-deployment">iRedMail Easy: Setup sudo for deployment</h1>
|
||
<div class="toc">
|
||
<ul>
|
||
<li><a href="#iredmail-easy-setup-sudo-for-deployment">iRedMail Easy: Setup sudo for deployment</a><ul>
|
||
<li><a href="#what-is-sudo-linux-and-doas-openbsd">What is sudo (Linux) and doas (OpenBSD)</a></li>
|
||
<li><a href="#linux-setup-sudo">Linux: Setup sudo</a></li>
|
||
<li><a href="#openbsd-setup-doas">OpenBSD: Setup doas</a></li>
|
||
<li><a href="#references">References</a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</div>
|
||
<h2 id="what-is-sudo-linux-and-doas-openbsd">What is <code>sudo</code> (Linux) and <code>doas</code> (OpenBSD)</h2>
|
||
<p>From <a href="https://en.wikipedia.org/wiki/Sudo">wikipedia</a>:</p>
|
||
<blockquote>
|
||
<p>sudo is a program for Unix-like computer operating systems that allows users
|
||
to run programs with the security privileges of another user, by default the
|
||
superuser <code>root</code>. It originally stood for "superuser do" as the older versions
|
||
of sudo were designed to run commands only as the superuser. However, the later
|
||
versions added support for running commands not only as the superuser but also
|
||
as other (restricted) users, ...</p>
|
||
<p>Unlike the similar command <code>su</code>, users must, by default, supply their own
|
||
password for authentication, rather than the password of the target user.
|
||
After authentication, and if the configuration file, which is typically
|
||
located at <code>/etc/sudoers</code>, permits the user access, the system invokes the
|
||
requested command. The configuration file offers detailed access permissions,
|
||
including enabling commands only from the invoking terminal; requiring a
|
||
password per user or group; requiring re-entry of a password every time or
|
||
never requiring a password at all for a particular command line. It can also
|
||
be configured to permit passing arguments or multiple commands.</p>
|
||
</blockquote>
|
||
<p>OpenBSD uses its own sudo-like program for this purpose, it's called <code>doas</code>
|
||
which means <em><strong>execute commands as another user</strong></em>.</p>
|
||
<p>With the iRedMail Easy, you can deploy iRedMail by connecting to
|
||
target server (via ssh) as a non-privileged user (e.g. user <code>iredmail</code>) which
|
||
is allowed to run command as <code>root</code> with <code>sudo</code>.</p>
|
||
<h2 id="linux-setup-sudo">Linux: Setup sudo</h2>
|
||
<p>Let's say you're going to connect as user <code>iredmail</code>:</p>
|
||
<ul>
|
||
<li>
|
||
<p>Run command <code>visudo</code> as root user.</p>
|
||
<p>Although you can edit sudo config file <code>/etc/sudoers</code> with your favourite
|
||
text editor, but <code>visudo</code> will help check syntax while saving changes. this
|
||
is helpful to avoid some mistakes like misspelled username, or any other
|
||
keyword.</p>
|
||
</li>
|
||
<li>
|
||
<p>Add lines below at the end, save your changes and quit <code>visudo</code>.</p>
|
||
</li>
|
||
</ul>
|
||
<pre><code># Allow user `iredmail` to run all commands without typing its own password.
|
||
iredmail ALL=(ALL) NOPASSWD: ALL
|
||
|
||
# We're going to connect without a real tty, below setting will speed up the
|
||
# iRedMail deployment process.
|
||
Defaults:iredmail !requiretty
|
||
</code></pre>
|
||
<p>To verify the sudo configuration, please login as user <code>iredmail</code> first, then run
|
||
command:</p>
|
||
<pre><code>sudo ls /root/
|
||
</code></pre>
|
||
<p>If sudo is correctly configured, it will show you list of files under <code>/root</code>
|
||
directory.</p>
|
||
<h2 id="openbsd-setup-doas">OpenBSD: Setup doas</h2>
|
||
<p>Let's say you're going to connect as user <code>iredmail</code>.</p>
|
||
<p>Append line below to file <code>/etc/doas.conf</code> (if this file doesn't exist, please
|
||
create it manually):</p>
|
||
<pre><code>permit nopass iredmail as root
|
||
</code></pre>
|
||
<p>To verify the sudo configuration, please login as user <code>iredmail</code> first, then run
|
||
command:</p>
|
||
<pre><code>doas ls /root/
|
||
</code></pre>
|
||
<p>If sudo is correctly configured, it will show you list of files under <code>/root</code>
|
||
directory.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li>Linux <code>sudo</code>:<ul>
|
||
<li><a href="https://www.sudo.ws/man/1.8.3/sudo.man.html">sudo manual page</a></li>
|
||
<li><a href="https://www.tecmint.com/sudoers-configurations-for-setting-sudo-in-linux/">10 Useful Sudoers Configurations for Setting ‘sudo’ in Linux</a></li>
|
||
<li><a href="https://www.tecmint.com/su-vs-sudo-and-how-to-configure-sudo-in-linux/">Difference Between su and sudo and How to Configure sudo in Linux</a></li>
|
||
</ul>
|
||
</li>
|
||
<li>OpenBSD <code>doas</code>:<ul>
|
||
<li><a href="https://man.openbsd.org/doas.conf.5">doas(5) manual page</a></li>
|
||
<li><a href="https://man.openbsd.org/doas.1">doas(1) manual page</a></li>
|
||
</ul>
|
||
</li>
|
||
</ul><div class="footer">
|
||
<p style="text-align: center; color: grey;">All documents are available in <a href="https://github.com/iredmail/docs/">GitHub repository</a>, and published under <a href="http://creativecommons.org/licenses/by-nd/3.0/us/" target="_blank">Creative Commons</a> license. You can <a href="https://github.com/iredmail/docs/archive/master.zip">download the latest version</a> for offline reading. If you found something wrong, please do <a href="https://www.iredmail.org/contact.html">contact us</a> to fix it.</p>
|
||
</div></body></html> |