[root@oldboyedu ~]# chage -l oldboy
Last password change                    : Oct 07, 2020
Password expires                    : never
Password inactive                   : never
Account expires                     : never
Minimum number of days between password change      : 0
Maximum number of days between password change      : 99999
Number of days of warning before password expires   : 7
[root@oldboyedu ~]# chage -E "2020/10/1" oldboy
[root@oldboyedu ~]# chage -l oldboy
Last password change                    : Oct 07, 2020
Password expires                    : never
Password inactive                   : never
Account expires                     : Oct 01, 2020
Minimum number of days between password change      : 0
Maximum number of days between password change      : 99999
Number of days of warning before password expires   : 7


范例14-17：創(chuàng)建新用戶range,要求該用戶7天內(nèi)不能更改密碼，
60天以后必須修改密碼，過期前10天通知用戶蛤签，過期后30天后禁止用戶登錄泻蚊。
chage -m7 -M60 -W10 -I30 oldboy
聯(lián)系英文：
Options:
  -d, --lastday LAST_DAY        set date of last password change to LAST_DAY
  -E, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE
  -h, --help                    display this help message and exit
  -I, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -l, --list                    show account aging information
  -m, --mindays MIN_DAYS        set minimum number of days before password
                                change to MIN_DAYS
  -M, --maxdays MAX_DAYS        set maximim number of days before password
                                change to MAX_DAYS
  -R, --root CHROOT_DIR         directory to chroot into
  -W, --warndays WARN_DAYS      set expiration warning days to WARN_DAYS

  
[root@oldboyedu ~]# chage -l oldboy
Last password change                    : Oct 07, 2020
Password expires                    : never
Password inactive                   : never
Account expires                     : Oct 01, 2020
Minimum number of days between password change      : 0
Maximum number of days between password change      : 99999
Number of days of warning before password expires   : 7
You have new mail in /var/spool/mail/root
[root@oldboyedu ~]# chage -m7 -M60 -W10 -I30 oldboy
[root@oldboyedu ~]# chage -l oldboy
Last password change                    : Oct 07, 2020
Password expires                    : Dec 06, 2020
Password inactive                   : Jan 05, 2021
Account expires                     : Oct 01, 2020
Minimum number of days between password change      : 7
Maximum number of days between password change      : 60
Number of days of warning before password expires   : 10

passwd -n70 -x600 -w100 -i300 oldboy

[root@oldboyedu ~]# passwd -n70 -x600 -w100 -i300 oldboy
Adjusting aging data for user oldboy.
passwd: Success
You have new mail in /var/spool/mail/root
[root@oldboyedu ~]# chage -l oldboy
Last password change                    : Oct 07, 2020
Password expires                    : May 30, 2022
Password inactive                   : Mar 26, 2023
Account expires                     : Oct 01, 2020
Minimum number of days between password change      : 70
Maximum number of days between password change      : 600
Number of days of warning before password expires   : 100



-n, --minimum DAYS
              This  will  set  the  minimum password lifetime, in days, if the user's account supports password life‐
              times.  Available to root only.

-x, --maximum DAYS
              This will set the maximum password lifetime, in days, if the user's  account  supports  password  life‐
              times.  Available to root only.

-w, --warning DAYS
              This  will  set  the number of days in advance the user will begin receiving warnings that her password
              will expire, if the user's account supports password lifetimes.  Available to root only.

-i, --inactive DAYS



[root@oldboyedu ~]# su - oldboy -c pwd
/home/oldboy
[root@oldboyedu ~]# su - oldboy -c whoami
oldboy


怎么用su靶病。

1会通、先登錄普通用戶，沒事不允許登錄root嫡秕。
只有執(zhí)行的任務(wù)需要root權(quán)限的時候才允許你登錄root渴语。
系統(tǒng)維護通道。
用su管理昆咽，必須知道root密碼，安全隱患牙甫。
10個運維掷酗，都得知道root密碼，安全隱患窟哺。

需求：
1泻轰、不用知道root密碼還能管理服務(wù)器。
2且轨、最小化管理服務(wù)器浮声，想關(guān)機，就只給你halt權(quán)限旋奢。


sudo命令：
可以以最小化的權(quán)限（單個命令）泳挥，執(zhí)行命令時擁有root用戶的權(quán)限

SUID 針對命令，任何用戶執(zhí)行命令都有root身份至朗。    任何用戶執(zhí)行某個命令：模糊
SUDO 針對用戶屉符，給某個用戶以root身份執(zhí)行某個命令。指定用戶執(zhí)行某個命令：具體锹引。


如何編輯配置sudo矗钟？

sudo是一個提權(quán)的命令（對應(yīng)權(quán)限通過讀取/etc/sudoers（嚴(yán)格語法）文件實現(xiàn)的）

配置/etc/sudoers可以使用visudo命令，或vim /etc/sudoers（不推薦）


[oldboy@oldboyedu ~]$ ls /root
ls: cannot open directory /root: Permission denied
完成上面的動作嫌变。

給oldboy用戶吨艇，針對ls設(shè)置權(quán)限。

visudo進入編輯狀態(tài)腾啥，100G

## Allow root to run any commands anywhere
root        ALL=(ALL)           ALL
oldboy      ALL=(ALL)           /usr/bin/ls,/bin/cp   #<===增加一行
用戶        主機=（角色）       命令

注意：
1东涡、路徑要全路徑：
which cp查
2、不要vim /etc/sudoers編輯碑宴，如果非要用編輯完visudo -c檢查語法

oldboy是管理員软啼，并且不要密碼：
oldboy  ALL=(ALL)       NOPASSWD: ALL

登錄后切到root運行。
[oldboy@oldboyedu ~]$ sudo su - root
Last login: Tue Mar 26 10:32:57 CST 2019 on pts/3
[root@oldboyedu ~]# 

為了安全禁止root遠(yuǎn)程連接linux延柠。

工作中如何登錄祸挪？使用普通用戶登錄然后利用sudo提權(quán)到root。
Wecomle to oldboy training 58期贞间。
[oldboy@oldboyedu ~]$ whoami
oldboy
[oldboy@oldboyedu ~]$ sudo ls /root
a.txt  c.txt  data1  etc       oldboy        oldboy_b       oldboy_soft_link  pass  test.txt      user.log
b.txt  d      d.txt  grep.txt  oldboy_1.txt  oldboyedu.txt  oldboy.txt        test  test.txt.ori
[oldboy@oldboyedu ~]$ 
[oldboy@oldboyedu ~]$ 
[oldboy@oldboyedu ~]$ sudo su -
Last login: Tue Mar 26 11:42:09 CST 2019 on pts/0
[root@oldboyedu ~]# 


[root@oldboyedu ~]# su - oldboy
Last login: Tue Mar 26 10:44:08 CST 2019 on pts/3
[oldboy@oldboyedu ~]$ ls /root
ls: cannot open directory /root: Permission denied
[oldboy@oldboyedu ~]$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for oldboy: 
Matching Defaults entries for oldboy on oldboyedu:
User oldboy may run the following commands on oldboyedu:
    (ALL) /bin/ls
[oldboy@oldboyedu ~]$ sudo ls /root
a.txt  c.txt  data1  etc       oldboy        oldboy_b       oldboy_soft_link  pass  test.txt      user.log
b.txt  d      d.txt  grep.txt  oldboy_1.txt  oldboyedu.txt  oldboy.txt        test  test.txt.ori
[oldboy@oldboyedu ~]$ ls /root
ls: cannot open directory /root: Permission denied
[oldboy@oldboyedu ~]$ 



練習(xí)：給普通用戶oldgirl增加添加用戶和刪除用戶權(quán)限贿条。


root用戶找回密碼
https://baijiahao.baidu.com/s?id=1614000108255096283&wfr=spider&for=pc