commit 1c70c6bce3a47cdf60317db0ec74ad9204579948
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Thu May 28 09:33:01 2015 +0200
Add links to RHEL7 Security Guide
en-US/Gaining_Privileges.xml | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/en-US/Gaining_Privileges.xml b/en-US/Gaining_Privileges.xml
index cde4151..7b6c519 100644
--- a/en-US/Gaining_Privileges.xml
+++ b/en-US/Gaining_Privileges.xml
@@ -7,7 +7,7 @@
System administrators, and in some cases users, need to perform certain tasks with
administrative access. Accessing the system as the <systemitem
class="username">root</systemitem> user is potentially dangerous and
can lead to widespread damage to the system and data. This chapter covers ways to gain
administrative privileges using setuid programs such as <command>su</command>
and <command>sudo</command>. These programs allow specific users to perform
tasks which would normally be available only to the <systemitem
class="username">root</systemitem> user while maintaining a higher
level of control and system security.
</para>
<para>
- See the <citetitle>&MAJOROS; Security Guide</citetitle> for more
information on administrative controls, potential dangers and ways to prevent data loss
resulting from improper use of privileged access.
+ See the <ulink
url="https://access.redhat.com/documentation/en-US/Red_Hat_Enterpris...
Enterprise Linux 7 Security Guide</ulink> for more information on
administrative controls, potential dangers, and ways to prevent data loss resulting from
improper use of privileged access.
</para>
<section id="sect-Gaining_Privileges-The_su_Command">
@@ -83,7 +83,7 @@
In the above example, <replaceable>command</replaceable> would be replaced
by a command normally reserved for the <systemitem
class="username">root</systemitem> user, such as
<command>mount</command>.
</para>
<para>
- The <command>sudo</command> command allows for a high degree of
flexibility. For instance, only users listed in the
<filename>/etc/sudoers</filename> configuration file are allowed to use the
<command>sudo</command> command and the command is executed in
<emphasis>the user's</emphasis> shell, not a <systemitem
class="username">root</systemitem> shell. This means the <systemitem
class="username">root</systemitem> shell can be completely disabled as
shown in the <citetitle>&MAJOROS; Security Guide</citetitle>.
+ The <command>sudo</command> command allows for a high degree of
flexibility. For instance, only users listed in the
<filename>/etc/sudoers</filename> configuration file are allowed to use the
<command>sudo</command> command and the command is executed in
<emphasis>the user's</emphasis> shell, not a <systemitem
class="username">root</systemitem> shell. This means the <systemitem
class="username">root</systemitem> shell can be completely disabled as
shown in the <ulink
url="https://access.redhat.com/documentation/en-US/Red_Hat_Enterpris...
Enterprise Linux 7 Security Guide</ulink>.
</para>
<para>
Each successful authentication using the <command>sudo</command> command
is logged to the file <filename>/var/log/messages</filename> and the command
issued along with the issuer's user name is logged to the file
<filename>/var/log/secure</filename>. If additional logging is required, use
the <systemitem>pam_tty_audit</systemitem> module to enable TTY auditing for
specified users by adding the following line to your
<filename>/etc/pam.d/system-auth</filename> file:
@@ -172,7 +172,7 @@
<itemizedlist>
<listitem>
<para>
- The <citetitle>&MAJOROS; Security Guide</citetitle> provides a more
in-depth look at potential security issues pertaining to setuid programs as well as
techniques used to alleviate these risks.
+ The <ulink
url="https://access.redhat.com/documentation/en-US/Red_Hat_Enterpris...
Enterprise Linux 7 Security Guide</ulink> provides a more in-depth
look at potential security issues pertaining to setuid programs as well as techniques used
to alleviate these risks.
</para>
</listitem>
</itemizedlist>