JumpServer

以下为个人测试过的权限控制，就是把Liux原生目录禁止删除（如dev，sys，proc等），经常变化的文件目录可以删除，Liunx目录结构如下图，图片为网络转载图片，此内容为原创内容

sudo权限控制模板

ALL,!/usr/bin/sudo,!/bin/bash,!/bin/tcsh,!/bin/su,!/usr/bin/passwd,!/usr/bin/passwd root,!/bin/vim /etc/sudoers,!/usr/bin/vim /etc/sudoers,!/usr/sbin/visudo,!/usr/bin/vim /etc/sudoers.d/*,!/bin/vi /etc/sudoers,!/usr/bin/vi /etc/sudoers,!/usr/bin/vi /etc/sudoers.d/*,!/usr/bin/sudo -i,!/bin/bi /etc/ssh/*,!/bin/chmod 777 /etc/*,!/bin/chmod 777 *,!/bin/chmod 777,!/bin/chmod -R 777 *,!/bin/rm /*,!/bin/rm /,!/bin/rm -f /*,!/bin/rm -f /,!/bin/rm -r /*,!/bin/rm -r /,!/bin/rm -rf /,!/bin/rm -rf /*,!/bin/rm /etc,!/bin/rm -r /etc,!/bin/rm -f /etc,!/bin/rm -rf /etc,!/bin/rm /etc/*,!/bin/rm -r /etc/*,!/bin/rm -f /etc/*,!/bin/rm -rf /etc/*,!/bin/rm /root,!/bin/rm -r /root,!/bin/rm -f /root,!/bin/rm -rf /root,!/bin/rm /root/*,!/bin/rm -r /root/*,!/bin/rm -f /root/*,!/bin/rm -rf /root/*,!/bin/rm /bin,!/bin/rm -r /bin,!/bin/rm -f /bin,!/bin/rm -rf /bin,!/bin/rm /bin/*,!/bin/rm -r /bin/*,!/bin/rm -f /bin/*,!/bin/rm -rf /bin/*,!/bin/rm /proc/*,!/bin/rm -r /proc/*,!/bin/rm -f /proc/*,!/bin/rm -rf /proc/*,!/bin/rm /proc,!/bin/rm -r /proc,!/bin/rm -f /proc,!/bin/rm -rf /proc,!/bin/rm /boot,!/bin/rm -r /boot,!/bin/rm -f /boot,!/bin/rm -rf /boot,!/bin/rm /boot/*,!/bin/rm -r /boot/*,!/bin/rm -f /boot/*,!/bin/rm -rf /boot/*,!/bin/rm /sys,!/bin/rm -r /sys,!/bin/rm -f /sys,!/bin/rm -rf /sys,!/bin/rm /sys/*,!/bin/rm -r /sys/*,!/bin/rm -f /sys/*,!/bin/rm -rf /sys/*,!/bin/rm /dev,!/bin/rm -r /dev,!/bin/rm -f /dev,!/bin/rm -rf /dev,!/bin/rm /dev/*,!/bin/rm -r /dev/*,!/bin/rm -f /dev/*,!/bin/rm -rf /dev/*,!/bin/rm /lib,!/bin/rm -r /lib,!/bin/rm -f /lib,!/bin/rm -rf /lib,!/bin/rm /lib/*,!/bin/rm -r /lib/*,!/bin/rm -f /lib/*,!/bin/rm -rf /lib/*,!/bin/rm /lib64,!/bin/rm -r /lib64,!/bin/rm -f /lib64,!/bin/rm -rf /lib64,!/bin/rm /lib64/*,!/bin/rm -r /lib64/*,!/bin/rm -f /lib64/*,!/bin/rm -rf /lib64/*,!/bin/rm /usr,!/bin/rm -r /usr,!/bin/rm -f /usr,!/bin/rm -rf /usr,!/bin/rm /usr/*,!/bin/rm -r /usr/*,!/bin/rm -f /usr/*,!/bin/rm -rf /usr/*,!/bin/rm /sbin,!/bin/rm -r /sbin,!/bin/rm -f /sbin,!/bin/rm -rf /sbin,!/bin/rm /sbin/*,!/bin/rm -r /sbin/*,!/bin/rm -f /sbin/*,!/bin/rm -rf /sbin/*

如果上述控制模板看不清楚请下载Atom将逗号换成换行符就能看明白了

第二行的!/usr/bin/sudo必须加上，否则使用jumpserver的时候输入sudo sudo rm命令依旧可以执行

有疑问的可以直接评论留言，大家尽量关注关注

JumpServer

以下为个人测试过的权限控制，就是把Liux原生目录禁止删除（如dev，sys，proc等），经常变化的文件目录可以删除，Liunx目录结构如下图，图片为网络转载图片，此内容为原创内容

sudo权限控制模板

ALL,!/usr/bin/sudo,!/bin/bash,!/bin/tcsh,!/bin/su,!/usr/bin/passwd,!/usr/bin/passwd root,!/bin/vim /etc/sudoers,!/usr/bin/vim /etc/sudoers,!/usr/sbin/visudo,!/usr/bin/vim /etc/sudoers.d/*,!/bin/vi /etc/sudoers,!/usr/bin/vi /etc/sudoers,!/usr/bin/vi /etc/sudoers.d/*,!/usr/bin/sudo -i,!/bin/bi /etc/ssh/*,!/bin/chmod 777 /etc/*,!/bin/chmod 777 *,!/bin/chmod 777,!/bin/chmod -R 777 *,!/bin/rm /*,!/bin/rm /,!/bin/rm -f /*,!/bin/rm -f /,!/bin/rm -r /*,!/bin/rm -r /,!/bin/rm -rf /,!/bin/rm -rf /*,!/bin/rm /etc,!/bin/rm -r /etc,!/bin/rm -f /etc,!/bin/rm -rf /etc,!/bin/rm /etc/*,!/bin/rm -r /etc/*,!/bin/rm -f /etc/*,!/bin/rm -rf /etc/*,!/bin/rm /root,!/bin/rm -r /root,!/bin/rm -f /root,!/bin/rm -rf /root,!/bin/rm /root/*,!/bin/rm -r /root/*,!/bin/rm -f /root/*,!/bin/rm -rf /root/*,!/bin/rm /bin,!/bin/rm -r /bin,!/bin/rm -f /bin,!/bin/rm -rf /bin,!/bin/rm /bin/*,!/bin/rm -r /bin/*,!/bin/rm -f /bin/*,!/bin/rm -rf /bin/*,!/bin/rm /proc/*,!/bin/rm -r /proc/*,!/bin/rm -f /proc/*,!/bin/rm -rf /proc/*,!/bin/rm /proc,!/bin/rm -r /proc,!/bin/rm -f /proc,!/bin/rm -rf /proc,!/bin/rm /boot,!/bin/rm -r /boot,!/bin/rm -f /boot,!/bin/rm -rf /boot,!/bin/rm /boot/*,!/bin/rm -r /boot/*,!/bin/rm -f /boot/*,!/bin/rm -rf /boot/*,!/bin/rm /sys,!/bin/rm -r /sys,!/bin/rm -f /sys,!/bin/rm -rf /sys,!/bin/rm /sys/*,!/bin/rm -r /sys/*,!/bin/rm -f /sys/*,!/bin/rm -rf /sys/*,!/bin/rm /dev,!/bin/rm -r /dev,!/bin/rm -f /dev,!/bin/rm -rf /dev,!/bin/rm /dev/*,!/bin/rm -r /dev/*,!/bin/rm -f /dev/*,!/bin/rm -rf /dev/*,!/bin/rm /lib,!/bin/rm -r /lib,!/bin/rm -f /lib,!/bin/rm -rf /lib,!/bin/rm /lib/*,!/bin/rm -r /lib/*,!/bin/rm -f /lib/*,!/bin/rm -rf /lib/*,!/bin/rm /lib64,!/bin/rm -r /lib64,!/bin/rm -f /lib64,!/bin/rm -rf /lib64,!/bin/rm /lib64/*,!/bin/rm -r /lib64/*,!/bin/rm -f /lib64/*,!/bin/rm -rf /lib64/*,!/bin/rm /usr,!/bin/rm -r /usr,!/bin/rm -f /usr,!/bin/rm -rf /usr,!/bin/rm /usr/*,!/bin/rm -r /usr/*,!/bin/rm -f /usr/*,!/bin/rm -rf /usr/*,!/bin/rm /sbin,!/bin/rm -r /sbin,!/bin/rm -f /sbin,!/bin/rm -rf /sbin,!/bin/rm /sbin/*,!/bin/rm -r /sbin/*,!/bin/rm -f /sbin/*,!/bin/rm -rf /sbin/*

如果上述控制模板看不清楚请下载Atom将逗号换成换行符就能看明白了

第二行的!/usr/bin/sudo必须加上，否则使用jumpserver的时候输入sudo sudo rm命令依旧可以执行

有疑问的可以直接评论留言，大家尽量关注关注