Belajar Sudo - Panduan Lengkap untuk Praktik Menggunakan Perintah Sudo

#!/bin/bash
# Advanced script to safely modify the /etc/sudoers file to add specific permissions for a user.
# Usage: sudo ./add_sudo_rule.sh username '/path/to/command' [nopass]
# Example: sudo ./add_sudo_rule.sh developer '/usr/sbin/service nginx restart' nopass

# Function to add a new sudo rule in the sudoers file safely
add_sudo_rule() {
    local user=$1
    local command=$2
    local nopass=$3
    local tmpfile=$(mktemp /tmp/sudoers.XXX)  # Create a temporary file with a secure pattern

    # Ensure the user exists on the system before proceeding
    if ! id "$user" &>/dev/null; then
        echo "Error: User '$user' does not exist."
        return 1
    fi

    # Backup the current sudoers file before making changes
    cp /etc/sudoers "$tmpfile"

    # Construct the sudo rule
    local rule="$user ALL=(ALL) "
    if [[ "$nopass" == "nopass" ]]; then
        rule+="NOPASSWD: $command"
    else
        rule+="PASSWD: $command"
    fi

    # Append the rule if it doesn't already exist to avoid duplicates
    if ! grep -Pq "^$(echo $rule | sed 's/[\*\.]/\\&/g')" /etc/sudoers; then
        echo "$rule" >> "$tmpfile"

        # Use visudo to check the syntax of the new sudoers file
        if visudo -c -f "$tmpfile"; then
            # Replace the original sudoers file if the new file is syntactically correct
            mv "$tmpfile" /etc/sudoers
            echo "New sudo rule added successfully."
        else
            echo "Error: Sudoers syntax check failed. Rule not added."
            return 1
        fi
    else
        echo "Rule already exists. No changes made."
    fi

    return 0
}

# Main script execution
# Ensure the script is run with root privileges
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root."
    exit 1
fi

# Check for the proper number of arguments
if [[ $# -lt 2 ]]; then
    echo "Usage: $0 username '/path/to/command' [nopass]"
    exit 1
fi

USERNAME=$1
COMMAND=$2
NOPASS=${3:-""}  # Default to requiring a password if not specified

add_sudo_rule "$USERNAME" "$COMMAND" "$NOPASS"

b. Gunakan Kata Sandi yang Kuat

password requisite pam_pwquality.so retry=3 minlen=12 difok=4

sudo apt-get install libpam-google-authenticator

# Add at the top of the file
auth required pam_google_authenticator.so

Defaults    logfile="/var/log/sudo.log"

Defaults    timestamp_timeout=2

f. Berpikir Dua Kali, Ketik Sekali

#!/bin/bash
echo "Warning: You are entering a protected area of the system. Please double-check your command for accuracy:"
read -p "Press Enter to continue or Ctrl+C to abort."
sudo "$@"