{"id":34958,"date":"2024-09-06T14:04:47","date_gmt":"2024-09-06T07:04:47","guid":{"rendered":"http:\/\/jupitek.maudemo.vip\/index.php\/2024\/09\/06\/use-cloud-init-to-manage-users-on-new-servers\/"},"modified":"2024-09-06T14:04:47","modified_gmt":"2024-09-06T07:04:47","slug":"use-cloud-init-to-manage-users-on-new-servers","status":"publish","type":"post","link":"https:\/\/jupitek.maudemo.vip\/index.php\/2024\/09\/06\/use-cloud-init-to-manage-users-on-new-servers\/","title":{"rendered":"S\u1eed d\u1ee5ng Cloud-Init \u0111\u1ec3 qu\u1ea3n l\u00fd ng\u01b0\u1eddi d\u00f9ng tr\u00ean server m\u1edbi"},"content":{"rendered":"<p><a href=\"https:\/\/cloudinit.readthedocs.io\/en\/latest\/index.html\" target=\"_blank\" rel=\"noreferrer noopener\">Cloud-init<\/a>&nbsp;l\u00e0 gi\u1ea3i ph\u00e1p ti\u00eau chu\u1ea9n c\u00f4ng nghi\u1ec7p \u0111\u1ec3 t\u1ef1 \u0111\u1ed9ng h\u00f3a vi\u1ec7c tri\u1ec3n khai m\u00e1y ch\u1ee7, h\u1ed7 tr\u1ee3 tr\u00ean nhi\u1ec1u n\u1ec1n t\u1ea3ng v\u00e0 b\u1ea3n ph\u00e2n ph\u1ed1i. K\u1ebft h\u1ee3p si\u00eau d\u1eef li\u1ec7u n\u1ec1n t\u1ea3ng v\u1edbi c\u00e1c t\u1eadp l\u1ec7nh d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng t\u00f9y ch\u1ec9nh, cloud-init c\u00f3 th\u1ec3 \u0111\u01a1n gi\u1ea3n h\u00f3a \u0111\u00e1ng k\u1ec3 qu\u00e1 tr\u00ecnh kh\u1edfi t\u1ea1o m\u00e1y ch\u1ee7 m\u1edbi.<\/p>\n<p>V\u1edbi d\u1ecbch v\u1ee5&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/products\/compute\/compute-instances\/guides\/metadata\/\">Metadata<\/a>&nbsp;c\u1ee7a Akamai , b\u1ea1n c\u00f3 th\u1ec3 t\u1eadn d\u1ee5ng cloud-init \u0111\u1ec3 tri\u1ec3n khai Compute Instances. M\u1ed9t t\u1eadp l\u1ec7nh d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng cloud-config c\u00f3 th\u1ec3 x\u00e1c \u0111\u1ecbnh m\u1ecdi th\u1ee9 b\u1ea1n c\u1ea7n \u0111\u1ec3 kh\u1edfi t\u1ea1o c\u00e1c phi\u00ean b\u1ea3n, t\u1eeb b\u1ea3o m\u1eadt v\u00e0 thi\u1ebft l\u1eadp ng\u01b0\u1eddi d\u00f9ng \u0111\u1ebfn c\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m v\u00e0 t\u1eadp l\u1ec7nh shell.<\/p>\n<p>H\u01b0\u1edbng d\u1eabn n\u00e0y tr\u00ecnh b\u00e0y chi ti\u1ebft c\u00e1ch b\u1eaft \u0111\u1ea7u l\u00e0m vi\u1ec7c v\u1edbi ng\u01b0\u1eddi d\u00f9ng nh\u01b0 m\u1ed9t ph\u1ea7n c\u1ee7a tri\u1ec3n khai cloud-init c\u1ee7a b\u1ea1n. \u0110\u1ecdc ti\u1ebfp \u0111\u1ec3 bi\u1ebft c\u00e1c t\u1eadp l\u1ec7nh cloud-config \u0111\u1ec3 cung c\u1ea5p ng\u01b0\u1eddi d\u00f9ng, th\u00eam kh\u00f3a SSH v\u00e0 v\u00f4 hi\u1ec7u h\u00f3a quy\u1ec1n truy c\u1eadp root t\u1eeb xa.<\/p>\n<p>Tr\u01b0\u1edbc khi b\u1eaft \u0111\u1ea7u, b\u1ea1n n\u00ean xem l\u1ea1i h\u01b0\u1edbng d\u1eabn c\u1ee7a ch\u00fang t\u00f4i v\u1ec1 c\u00e1ch&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/configure-and-secure-servers-with-cloud-init\/\">s\u1eed d\u1ee5ng Cloud-Init \u0111\u1ec3 t\u1ef1 \u0111\u1ed9ng c\u1ea5u h\u00ecnh v\u00e0 b\u1ea3o m\u1eadt m\u00e1y ch\u1ee7 c\u1ee7a b\u1ea1n<\/a>&nbsp;. \u1ede \u0111\u00f3, b\u1ea1n c\u00f3 th\u1ec3 xem c\u00e1ch t\u1ea1o t\u1ec7p cloud-config, t\u1ec7p m\u00e0 b\u1ea1n c\u1ea7n l\u00e0m theo h\u01b0\u1edbng d\u1eabn hi\u1ec7n t\u1ea1i. Khi b\u1ea1n \u0111\u00e3 s\u1eb5n s\u00e0ng tri\u1ec3n khai cloud-config, h\u01b0\u1edbng d\u1eabn \u0111\u01b0\u1ee3c li\u00ean k\u1ebft \u1edf tr\u00ean s\u1ebd cho bi\u1ebft c\u00e1ch th\u1ef1c hi\u1ec7n.<\/p>\n<h2 id=\"create-user\">T\u1ea1o ng\u01b0\u1eddi d\u00f9ng<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#create-user\"><\/a><\/h2>\n<p>Trong m\u1ed9t t\u1eadp l\u1ec7nh cloud-config,&nbsp;<code>users<\/code>t\u00f9y ch\u1ecdn n\u00e0y x\u1eed l\u00fd vi\u1ec7c t\u1ea1o ng\u01b0\u1eddi d\u00f9ng v\u00e0 h\u1ea7u h\u1ebft c\u00e1c t\u00ednh n\u0103ng \u0111\u1ec3 qu\u1ea3n l\u00fd ng\u01b0\u1eddi d\u00f9ng. \u1ede m\u1ee9c \u0111\u01a1n gi\u1ea3n nh\u1ea5t, t\u00f9y ch\u1ecdn n\u00e0y c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng v\u1edbi \u00edt nh\u1ea5t m\u1ed9t m\u1ee5c, \u0111\u1ea3m b\u1ea3o r\u1eb1ng cloud-init t\u1ea1o ra ng\u01b0\u1eddi d\u00f9ng m\u1eb7c \u0111\u1ecbnh. B\u1ea5t k\u1ec3 b\u1ea1n th\u00eam ng\u01b0\u1eddi d\u00f9ng n\u00e0o kh\u00e1c, b\u1ea1n&nbsp;c\u0169ng&nbsp;<code>default<\/code>n\u00ean gi\u1eef m\u1ed9t m\u1ee5c nh\u1eadp cho ng\u01b0\u1eddi d\u00f9ng \u0111\u00f3.<code>default<\/code><\/p>\n<pre class=\"wp-block-code\"><code>users:\n  - default<\/code><\/pre>\n<p>\u0110\u1ec3 t\u1ea1o th\u00eam ng\u01b0\u1eddi d\u00f9ng, h\u00e3y th\u00eam m\u1ed9t m\u1ee5c kh\u00e1c v\u00e0o danh s\u00e1ch v\u1edbi \u00edt nh\u1ea5t m\u1ed9t&nbsp;<code>name<\/code>tr\u01b0\u1eddng x\u00e1c \u0111\u1ecbnh t\u00ean ng\u01b0\u1eddi d\u00f9ng. V\u00ed d\u1ee5, \u0111\u1ec3 t\u1ea1o&nbsp;<code>example-user<\/code>, b\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng c\u1ea5u h\u00ecnh nh\u01b0 th\u1ebf n\u00e0y.<\/p>\n<pre class=\"wp-block-code\"><code>users:\n  - default\n  - name: example-user<\/code><\/pre>\n<p>Qu\u00e1 tr\u00ecnh cloud-init thi\u1ebft l\u1eadp ng\u01b0\u1eddi d\u00f9ng v\u1edbi m\u1ed9t lo\u1ea1t c\u00e1c m\u1eb7c \u0111\u1ecbnh, nh\u01b0 th\u01b0 m\u1ee5c home v\u00e0 nh\u00f3m ng\u01b0\u1eddi d\u00f9ng. Tuy nhi\u00ean, b\u1ea1n th\u01b0\u1eddng mu\u1ed1n ki\u1ec3m so\u00e1t nhi\u1ec1u h\u01a1n m\u1ed9t ch\u00fat vi\u1ec7c t\u1ea1o ng\u01b0\u1eddi d\u00f9ng, \u0111\u1eb7c bi\u1ec7t l\u00e0 n\u1ebfu b\u1ea1n \u0111\u1ecbnh truy c\u1eadp ng\u01b0\u1eddi d\u00f9ng qua SSH. C\u00e1c ph\u1ea7n ti\u1ebfp theo s\u1ebd \u0111\u1ec1 c\u1eadp \u0111\u1ebfn c\u00e1c t\u00ednh n\u0103ng nh\u01b0&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#manage-and-assign-groups\">ch\u1ec9 \u0111\u1ecbnh nh\u00f3m<\/a>&nbsp;(bao g\u1ed3m&nbsp;<code>sudo<\/code>quy\u1ec1n truy c\u1eadp) v\u00e0&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#add-an-ssh-key-to-a-user\">th\u00eam kh\u00f3a SSH<\/a>&nbsp;cho ng\u01b0\u1eddi d\u00f9ng. Trong v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi v\u00e0 ph\u1ea7n ph\u00e2n t\u00edch \u0111i k\u00e8m, c\u00f3 m\u1ed9t s\u1ed1 t\u00f9y ch\u1ecdn h\u1eefu \u00edch b\u1ed5 sung \u0111\u1ec3 qu\u1ea3n l\u00fd ng\u01b0\u1eddi d\u00f9ng m\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>users:\n  - default\n  - name: example-user\n    gecos: Example User,600-700-8090\n    shell: \/bin\/bash\n    lock_passwd: false\n    passwd: &lt;PASSWORD_HASH&gt;<\/code><\/pre>\n<p>\u0110i\u1ec1u n\u00e0y t\u1ea1o ra m\u1ed9t ng\u01b0\u1eddi d\u00f9ng c\u01a1 b\u1ea3n, c\u00f3 th\u1ec3 truy c\u1eadp b\u1eb1ng t\u00ean ng\u01b0\u1eddi d\u00f9ng v\u00e0 m\u1eadt kh\u1ea9u. Sau \u0111\u00e2y l\u00e0 gi\u1ea3i th\u00edch v\u1ec1 ch\u1ee9c n\u0103ng c\u1ee7a t\u1eebng ph\u1ea7n trong v\u00ed d\u1ee5:<\/p>\n<ul>\n<li><code>name<\/code>: X\u00e1c \u0111\u1ecbnh t\u00ean ng\u01b0\u1eddi d\u00f9ng cho ng\u01b0\u1eddi d\u00f9ng. Tr\u01b0\u1eddng n\u00e0y l\u00e0 b\u1eaft bu\u1ed9c.<\/li>\n<li><code>gecos<\/code>: Cung c\u1ea5p b\u00ecnh lu\u1eadn v\u1ec1 ng\u01b0\u1eddi d\u00f9ng. \u0110\u00e2y l\u00e0 n\u01a1i b\u1ea1n c\u00f3 th\u1ec3 nh\u1eadp th\u00f4ng tin GECOS cho ng\u01b0\u1eddi d\u00f9ng, ch\u1eb3ng h\u1ea1n nh\u01b0 t\u00ean th\u1eadt v\u00e0 th\u00f4ng tin li\u00ean l\u1ea1c. M\u1ed7i th\u00f4ng tin ph\u1ea3i \u0111\u01b0\u1ee3c ph\u00e2n t\u00e1ch b\u1eb1ng d\u1ea5u ph\u1ea9y.<\/li>\n<li><code>shell<\/code>: Tr\u1ecf \u0111\u1ebfn shell cho ng\u01b0\u1eddi d\u00f9ng. M\u1eb7c d\u00f9 kh\u00f4ng b\u1eaft bu\u1ed9c, shell c\u1ee7a ng\u01b0\u1eddi d\u00f9ng c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng kh\u00f4ng mong mu\u1ed1n n\u1ebfu b\u1ea1n kh\u00f4ng cung c\u1ea5p r\u00f5 r\u00e0ng tr\u01b0\u1eddng n\u00e0y.<\/li>\n<li><code>lock_passwd<\/code>: C\u00f3 n\u00ean v\u00f4 hi\u1ec7u h\u00f3a \u0111\u0103ng nh\u1eadp b\u1eb1ng m\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng hay kh\u00f4ng. M\u1eb7c \u0111\u1ecbnh&nbsp;<code>true<\/code>l\u00e0 khuy\u1ebfn ngh\u1ecb s\u1eed d\u1ee5ng quy\u1ec1n truy c\u1eadp SSH thay th\u1ebf. \u0110i\u1ec1u n\u00e0y l\u00e0 do, ngo\u00e0i vi\u1ec7c kh\u00f3a SSH th\u01b0\u1eddng an to\u00e0n h\u01a1n, h\u00e0m b\u0103m m\u1eadt kh\u1ea9u \u0111\u01b0\u1ee3c bao g\u1ed3m trong cloud-config, khi\u1ebfn vi\u1ec7c b\u1ea3o m\u1eadt tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/li>\n<li><code>passwd<\/code>: X\u00e1c \u0111\u1ecbnh m\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng d\u01b0\u1edbi d\u1ea1ng b\u0103m m\u1eadt kh\u1ea9u. \u0110\u1ec3 \u0111\u0103ng nh\u1eadp b\u1eb1ng ng\u01b0\u1eddi d\u00f9ng s\u1eed d\u1ee5ng m\u1eadt kh\u1ea9u n\u00e0y, t\u00f9y&nbsp;<code>lock_passwd<\/code>ch\u1ecdn c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u1eb7t th\u00e0nh&nbsp;<code>false<\/code>. B\u1ea1n c\u00f3 th\u1ec3 t\u1ea1o b\u0103m m\u1eadt kh\u1ea9u b\u1eb1ng l\u1ec7nh sau:<code>mkpasswd --method<strong>=<\/strong>SHA-512 --rounds<strong>=<\/strong>4096<\/code><\/li>\n<\/ul>\n<p class=\"has-background\" style=\"background-color:#74f78c33\">Ghi ch\u00fa: C\u1ea5u h\u00ecnh h\u1ed7 tr\u1ee3&nbsp;<code>plain_text_passwd<\/code>t\u00f9y ch\u1ecdn, trong \u0111\u00f3 b\u1ea1n c\u00f3 th\u1ec3 \u0111\u1eb7t m\u1eadt kh\u1ea9u ng\u01b0\u1eddi d\u00f9ng t\u1eeb v\u0103n b\u1ea3n thu\u1ea7n t\u00fay, thay v\u00ec b\u0103m. Tuy nhi\u00ean, b\u1ea1n kh\u00f4ng n\u00ean s\u1eed d\u1ee5ng t\u00f9y ch\u1ecdn n\u00e0y trong m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t, v\u00ec m\u1eadt kh\u1ea9u th\u1eadm ch\u00ed c\u00f2n d\u1ec5 b\u1ecb l\u1ed9 h\u01a1n.<\/p>\n<p>\u0110\u1ec3 bi\u1ebft \u0111\u1ea7y \u0111\u1ee7 c\u00e1c t\u00f9y ch\u1ecdn c\u1ea5u h\u00ecnh ng\u01b0\u1eddi d\u00f9ng, h\u00e3y xem t\u00e0i li\u1ec7u tham kh\u1ea3o m\u00f4-&nbsp;<a href=\"https:\/\/cloudinit.readthedocs.io\/en\/latest\/reference\/modules.html#users-and-groups\" target=\"_blank\" rel=\"noreferrer noopener\">\u0111un Ng\u01b0\u1eddi d\u00f9ng v\u00e0 Nh\u00f3m<\/a>&nbsp;c\u1ee7a cloud-init .<\/p>\n<h2 id=\"manage-and-assign-groups\">Qu\u1ea3n l\u00fd v\u00e0 ch\u1ec9 \u0111\u1ecbnh nh\u00f3m<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#manage-and-assign-groups\"><\/a><\/h2>\n<p>T\u1eadp l\u1ec7nh cloud-config c\u1ee7a b\u1ea1n c\u00f3 th\u1ec3 qu\u1ea3n l\u00fd nh\u00f3m ng\u01b0\u1eddi d\u00f9ng \u0111\u1ed9c l\u1eadp b\u1eb1ng t\u00f9y&nbsp;<code>groups<\/code>ch\u1ecdn ho\u1eb7c trong m\u1ed9t&nbsp;<code>users<\/code>m\u1ee5c nh\u1eadp. T\u00f9y ch\u1ecdn n\u00e0y&nbsp;<code>groups<\/code>cung c\u1ea5p cho b\u1ea1n nhi\u1ec1u quy\u1ec1n ki\u1ec3m so\u00e1t h\u01a1n \u0111\u1ed1i v\u1edbi ch\u00ednh c\u00e1c nh\u00f3m v\u00e0 cho ph\u00e9p b\u1ea1n th\u00eam ng\u01b0\u1eddi d\u00f9ng hi\u1ec7n t\u1ea1i, nh\u01b0&nbsp;<code>root<\/code>ng\u01b0\u1eddi d\u00f9ng m\u1eb7c \u0111\u1ecbnh, v\u00e0o c\u00e1c nh\u00f3m m\u1edbi.<\/p>\n<p>B\u00ean d\u01b0\u1edbi&nbsp;<code>groups<\/code>, b\u1ea1n c\u00f3 danh s\u00e1ch c\u00e1c nh\u00f3m c\u1ea7n th\u00eam v\u00e0o h\u1ec7 th\u1ed1ng. Ch\u1ec9 c\u1ea7n li\u1ec7t k\u00ea t\u00ean c\u1ee7a m\u1ed9t nh\u00f3m, nh\u01b0&nbsp;<code>user-group<\/code>b\u00ean d\u01b0\u1edbi, s\u1ebd t\u1ea1o ra m\u1ed9t nh\u00f3m tr\u1ed1ng. Th\u00eam danh s\u00e1ch t\u00ean ng\u01b0\u1eddi d\u00f9ng b\u00ean d\u01b0\u1edbi t\u00ean nh\u00f3m, nh\u01b0 b\u00ean&nbsp;<code>admin-group<\/code>d\u01b0\u1edbi, s\u1ebd kh\u1edfi t\u1ea1o h\u1ec7 th\u1ed1ng v\u1edbi nh\u1eefng ng\u01b0\u1eddi d\u00f9ng thu\u1ed9c nh\u00f3m \u0111\u00f3.<\/p>\n<pre class=\"wp-block-code\"><code>groups:\n  - admin-group:\n    - root\n  - user-group<\/code><\/pre>\n<p>Cloud-config c\u0169ng h\u1ed7 tr\u1ee3 m\u1ed9t&nbsp;<code>groups<\/code>t\u00f9y ch\u1ecdn trong m\u1ed7i&nbsp;<code>users<\/code>m\u1ee5c nh\u1eadp. S\u1eed d\u1ee5ng&nbsp;<code>groups<\/code>t\u00f9y ch\u1ecdn n\u00e0y cung c\u1ea5p m\u1ed9t c\u00e1ch ti\u1ebfp c\u1eadn t\u1eadp trung v\u00e0o ng\u01b0\u1eddi d\u00f9ng h\u01a1n, cho ph\u00e9p b\u1ea1n t\u1ea1o v\u00e0 ch\u1ec9 \u0111\u1ecbnh c\u00e1c nh\u00f3m theo t\u1eebng ng\u01b0\u1eddi d\u00f9ng. Trong v\u00ed d\u1ee5 d\u01b0\u1edbi \u0111\u00e2y, m\u1ed9t&nbsp;<code>example-group<\/code>nh\u00f3m m\u1edbi \u0111\u01b0\u1ee3c t\u1ea1o c\u00f9ng v\u1edbi ng\u01b0\u1eddi d\u00f9ng v\u00e0 ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c ch\u1ec9 \u0111\u1ecbnh v\u00e0o nh\u00f3m \u0111\u00f3.<\/p>\n<pre class=\"wp-block-code\"><code>users:\n  - name: example-user\n    groups:\n      - example-group<\/code><\/pre>\n<p>Theo m\u1eb7c \u0111\u1ecbnh, cloud-init t\u1ea1o v\u00e0 g\u00e1n m\u1ed7i ng\u01b0\u1eddi d\u00f9ng cho m\u1ed9t nh\u00f3m ng\u01b0\u1eddi d\u00f9ng t\u1ef1 \u0111\u1eb7t t\u00ean. V\u00ec v\u1eady, ng\u01b0\u1eddi d\u00f9ng \u1edf tr\u00ean,&nbsp;<code>example-user<\/code>, th\u1ef1c s\u1ef1 thu\u1ed9c v\u1ec1 hai nh\u00f3m:&nbsp;<code>example-user<\/code>v\u00e0&nbsp;<code>example-group<\/code>. B\u1ea1n c\u00f3 th\u1ec3 thi\u1ebft l\u1eadp&nbsp;<code>no_user_group: true<\/code>ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng t\u1ea1o nh\u00f3m m\u1eb7c \u0111\u1ecbnh&nbsp;<code>example-user<\/code>.<\/p>\n<h3 id=\"assigning-sudo-access\">Ch\u1ec9 \u0111\u1ecbnh quy\u1ec1n truy c\u1eadp Sudo<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#assigning-sudo-access\"><\/a><\/h3>\n<p>Cloud-init ki\u1ec3m so\u00e1t&nbsp;<code>sudo<\/code>quy\u1ec1n truy c\u1eadp c\u1ee7a ng\u01b0\u1eddi d\u00f9ng ch\u1ee7 y\u1ebfu th\u00f4ng qua&nbsp;<code>sudo<\/code>t\u00f9y ch\u1ecdn. T\u00f9y ch\u1ecdn n\u00e0y l\u1ea5y danh s\u00e1ch&nbsp;<code>sudo<\/code>c\u00e1c chu\u1ed7i quy t\u1eafc, ch\u1ec9 c\u1ea7n ch\u00fang xu\u1ea5t hi\u1ec7n trong&nbsp;<code>sudoers<\/code>t\u1ec7p. B\u1ea1n c\u00f3 th\u1ec3 t\u00ecm hi\u1ec3u th\u00eam v\u1ec1&nbsp;<code>sudo<\/code>quy\u1ec1n truy c\u1eadp v\u00e0&nbsp;<code>sudo<\/code>quy t\u1eafc trong c\u00e1c ph\u1ea7n th\u00edch h\u1ee3p c\u1ee7a h\u01b0\u1edbng d\u1eabn&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/linux-users-and-groups\/#understanding-the-sudo-linux-group-and-user\">Ng\u01b0\u1eddi d\u00f9ng v\u00e0 Nh\u00f3m Linux<\/a>&nbsp;c\u1ee7a ch\u00fang t\u00f4i .<\/p>\n<p>Trong v\u00ed d\u1ee5 d\u01b0\u1edbi \u0111\u00e2y, m\u1ed9t c\u00e1i m\u1edbi&nbsp;<code>example-user<\/code>\u0111\u01b0\u1ee3c t\u1ea1o v\u00e0 c\u1ea5p&nbsp;<code>sudo<\/code>quy\u1ec1n truy c\u1eadp. M\u1ed9t quy t\u1eafc \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng ch\u1ea1y b\u1ea5t k\u1ef3 l\u1ec7nh n\u00e0o&nbsp;<code>sudo<\/code>sau khi nh\u1eadp m\u1eadt kh\u1ea9u c\u1ee7a ng\u01b0\u1eddi d\u00f9ng. V\u00ed d\u1ee5 n\u00e0y c\u0169ng th\u00eam ng\u01b0\u1eddi d\u00f9ng v\u00e0o&nbsp;<code>sudo<\/code>nh\u00f3m ng\u01b0\u1eddi d\u00f9ng.<\/p>\n<pre class=\"wp-block-code\"><code>users:\n  - name: example-user\n    groups:\n      - sudo\n    sudo:\n      - ALL=(ALL:ALL) ALL<\/code><\/pre>\n<p>Ngo\u00e0i ra, b\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng quy t\u1eafc sau&nbsp;<code>sudoers<\/code>\u0111\u1ec3 cho ph\u00e9p&nbsp;<code>sudo<\/code>truy c\u1eadp m\u00e0 kh\u00f4ng c\u1ea7n nh\u1eadp m\u1eadt kh\u1ea9u. \u0110i\u1ec1u n\u00e0y h\u1eefu \u00edch cho nh\u1eefng ng\u01b0\u1eddi d\u00f9ng m\u00e0 b\u1ea1n \u0111\u00e3 thi\u1ebft l\u1eadp quy\u1ec1n truy c\u1eadp kh\u00f3a SSH nh\u01b0ng ch\u01b0a cung c\u1ea5p m\u1eadt kh\u1ea9u.<\/p>\n<pre class=\"wp-block-code\"><code>...\n    sudo:\n      - ALL=(ALL) NOPASSWD:ALL<\/code><\/pre>\n<h2 id=\"add-an-ssh-key-to-a-user\">Th\u00eam Kh\u00f3a SSH cho Ng\u01b0\u1eddi d\u00f9ng<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#add-an-ssh-key-to-a-user\"><\/a><\/h2>\n<p>S\u1eed d\u1ee5ng t\u00f9y ch\u1ecdn n\u00e0y&nbsp;<code>ssh_authorized_keys<\/code>, b\u1ea1n c\u00f3 th\u1ec3 \u1ee7y quy\u1ec1n danh s\u00e1ch kh\u00f3a c\u00f4ng khai SSH \u0111\u1ec3 truy c\u1eadp ng\u01b0\u1eddi d\u00f9ng t\u1eeb xa. L\u00e0m nh\u01b0 v\u1eady cung c\u1ea5p m\u1ed9t tuy\u1ebfn \u1ee7y quy\u1ec1n an to\u00e0n h\u01a1n so v\u1edbi m\u1eadt kh\u1ea9u v\u00e0 do \u0111\u00f3 \u0111\u01b0\u1ee3c khuy\u1ebfn ngh\u1ecb h\u01a1n l\u00e0 c\u1ea5u h\u00ecnh m\u1eadt kh\u1ea9u.<\/p>\n<p>N\u1ebfu b\u1ea1n ch\u01b0a c\u00f3 c\u1eb7p kh\u00f3a SSH, h\u00e3y t\u1ea1o m\u1ed9t c\u1eb7p b\u1eb1ng c\u00e1ch l\u00e0m theo ph\u1ea7n c\u00f3 li\u00ean quan trong h\u01b0\u1edbng d\u1eabn c\u1ee7a ch\u00fang t\u00f4i v\u1ec1 c\u00e1ch&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/use-public-key-authentication-with-ssh\/#generate-an-ssh-key-pair\">s\u1eed d\u1ee5ng X\u00e1c th\u1ef1c kh\u00f3a c\u00f4ng khai SSH<\/a>&nbsp;.<\/p>\n<p>Sau khi b\u1ea1n c\u00f3 c\u1eb7p kh\u00f3a SSH, b\u1ea1n c\u00f3 th\u1ec3 th\u00eam kh\u00f3a c\u00f4ng khai SSH c\u1ee7a m\u00ecnh v\u00e0o&nbsp;<code>ssh_authorized_keys<\/code>danh s\u00e1ch trong c\u1ea5u h\u00ecnh ng\u01b0\u1eddi d\u00f9ng. Trong v\u00ed d\u1ee5 n\u00e0y,&nbsp;<code>example-user<\/code>\u0111\u00e3 \u1ee7y quy\u1ec1n truy c\u1eadp t\u1eeb hai kh\u00f3a SSH:<\/p>\n<pre class=\"wp-block-code\"><code>users:\n  - name: example-user\n    shell: \/bin\/bash\n    ssh_authorized_keys:\n      - &lt;SSH_PUBLIC_KEY_FIRST&gt;\n      - &lt;SSH_PUBLIC_KEY_SECOND&gt;<\/code><\/pre>\n<p>V\u1edbi thi\u1ebft l\u1eadp n\u00e0y, m\u1ed9t m\u00e1y c\u00f3 kh\u00f3a ri\u00eang SSH ph\u00f9 h\u1ee3p (th\u01b0\u1eddng l\u00e0 n\u01a1i b\u1ea1n t\u1ea1o c\u1eb7p kh\u00f3a) c\u00f3 th\u1ec3 truy c\u1eadp&nbsp;<code>example-user<\/code>qua SSH. Kh\u00f3a SSH cung c\u1ea5p x\u00e1c th\u1ef1c v\u00e0 th\u1ef1c hi\u1ec7n vi\u1ec7c n\u00e0y an to\u00e0n h\u01a1n so v\u1edbi nh\u1eadp m\u1eadt kh\u1ea9u th\u1ee7 c\u00f4ng.<\/p>\n<h2 id=\"disable-root-user\">V\u00f4 hi\u1ec7u h\u00f3a ng\u01b0\u1eddi d\u00f9ng g\u1ed1c<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#disable-root-user\"><\/a><\/h2>\n<p>V\u1ec1 m\u1eb7t b\u1ea3o m\u1eadt, th\u01b0\u1eddng th\u00ec n\u00ean v\u00f4 hi\u1ec7u h\u00f3a \u0111\u0103ng nh\u1eadp root qua SSH. \u0110i\u1ec1u n\u00e0y h\u1ea1n ch\u1ebf kh\u1ea3 n\u0103ng ng\u01b0\u1eddi d\u00f9ng root c\u1ee7a b\u1ea1n b\u1ecb l\u1ed9 v\u00e0 kh\u1ea3 n\u0103ng h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n b\u1ecb truy c\u1eadp v\u1edbi to\u00e0n b\u1ed9 quy\u1ec1n root.<\/p>\n<p>\u0110\u1ec3 v\u00f4 hi\u1ec7u h\u00f3a quy\u1ec1n truy c\u1eadp g\u1ed1c qua SSH, b\u1ea1n c\u1ea7n s\u1eeda \u0111\u1ed5i t\u1ec7p c\u1ea5u h\u00ecnh SSH v\u00e0 kh\u1edfi \u0111\u1ed9ng l\u1ea1i d\u1ecbch v\u1ee5 SSH c\u1ee7a h\u1ec7 th\u1ed1ng. T\u1ea5t c\u1ea3 nh\u1eefng \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng m\u1ed9t lo\u1ea1t l\u1ec7nh shell, m\u00e0 cloud-config s\u1eed d\u1ee5ng trong t\u00f9y&nbsp;<code>runcmd<\/code>ch\u1ecdn. V\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi s\u1eed d\u1ee5ng ba l\u1ec7nh \u0111\u1ec3 s\u1eeda \u0111\u1ed5i c\u1ea5u h\u00ecnh d\u1ecbch v\u1ee5 SSH:<\/p>\n<ul>\n<li>L\u1ec7nh n\u00e0y&nbsp;<code>sed<\/code>x\u00f3a b\u1ea5t k\u1ef3&nbsp;<code>PermitRootLogin<\/code>d\u00f2ng n\u00e0o \u0111\u00e3 c\u00f3 trong t\u1ec7p c\u1ea5u h\u00ecnh. Do \u0111\u00f3, b\u1ea5t k\u1ef3 thi\u1ebft l\u1eadp hi\u1ec7n c\u00f3 n\u00e0o c\u0169ng b\u1ecb x\u00f3a v\u00e0 b\u1ecf qua c\u00e1c l\u1ec7nh ph\u1ee9c t\u1ea1p h\u01a1n c\u1ed1 g\u1eafng x\u00e1c \u0111\u1ecbnh c\u00e1c thi\u1ebft l\u1eadp \u0111\u00e3 \u0111\u01b0\u1ee3c ch\u00fa th\u00edch.<\/li>\n<li>L\u1ec7nh n\u00e0y&nbsp;<code>echo<\/code>th\u00eam m\u1ed9t thi\u1ebft l\u1eadp m\u1edbi&nbsp;<code>PermitRootLogin<\/code>v\u00e0o t\u1ec7p c\u1ea5u h\u00ecnh, v\u1edbi gi\u00e1 tr\u1ecb l\u00e0&nbsp;<code>no<\/code>v\u00f4 hi\u1ec7u h\u00f3a \u0111\u0103ng nh\u1eadp root.<\/li>\n<li>L\u1ec7nh n\u00e0y&nbsp;<code>systemctl<\/code>kh\u1edfi \u0111\u1ed9ng l\u1ea1i d\u1ecbch v\u1ee5 SSH \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o c\u00e0i \u0111\u1eb7t c\u00f3 hi\u1ec7u l\u1ef1c ngay l\u1eadp t\u1ee9c.<\/li>\n<\/ul>\n<pre class=\"wp-block-code\"><code>runcmd:\n  - sed -i '\/PermitRootLogin\/d' \/etc\/ssh\/sshd_config\n  - echo \"PermitRootLogin no\" &gt;&gt; \/etc\/ssh\/sshd_config\n  - systemctl restart sshd<\/code><\/pre>\n<h2 id=\"verify-user-configuration\">X\u00e1c minh c\u1ea5u h\u00ecnh ng\u01b0\u1eddi d\u00f9ng<a href=\"https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/#verify-user-configuration\"><\/a><\/h2>\n<p>Sau khi cloud-init ho\u00e0n t\u1ea5t qu\u00e1 tr\u00ecnh kh\u1edfi t\u1ea1o m\u00e1y ch\u1ee7, h\u00e3y x\u00e1c minh r\u1eb1ng c\u1ea5u h\u00ecnh ng\u01b0\u1eddi d\u00f9ng v\u00e0 nh\u00f3m c\u1ee7a b\u1ea1n \u0111\u00e3 tri\u1ec3n khai theo \u0111\u00fang d\u1ef1 \u0111\u1ecbnh. \u0110\u1ed1i v\u1edbi m\u1ed9t s\u1ed1 th\u00e0nh ph\u1ea7n \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh trong su\u1ed1t h\u01b0\u1edbng d\u1eabn n\u00e0y, x\u00e1c minh \u0111\u01a1n gi\u1ea3n nh\u1ea5t th\u01b0\u1eddng ch\u1ec9 l\u00e0 k\u1ebft n\u1ed1i v\u1edbi ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 cho qua SSH.<\/p>\n<p>V\u00ed d\u1ee5, n\u1ebfu cloud-config c\u1ee7a b\u1ea1n \u0111\u01b0\u1ee3c t\u1ea1o&nbsp;<code>example-user<\/code>b\u1eb1ng kh\u00f3a SSH, b\u1ea1n s\u1ebd c\u00f3 th\u1ec3 k\u1ebft n\u1ed1i v\u1edbi m\u00e1y ch\u1ee7 v\u1edbi t\u01b0 c\u00e1ch l\u00e0 ng\u01b0\u1eddi d\u00f9ng \u0111\u00f3 qua SSH. Thay th\u1ebf&nbsp;<code>192.0.2.17<\/code>b\u00ean d\u01b0\u1edbi b\u1eb1ng \u0111\u1ecba ch\u1ec9 IP th\u1ef1c t\u1ebf c\u1ee7a m\u00e1y ch\u1ee7 \u0111\u00e3 tri\u1ec3n khai.<\/p>\n<pre class=\"wp-block-code\"><code>ssh example-user@192.0.2.17<\/code><\/pre>\n<p>N\u1ebfu b\u1ea1n \u0111\u00e3 t\u1eaft quy\u1ec1n truy c\u1eadp root t\u1eeb xa, b\u1ea1n s\u1ebd c\u00f3 th\u1ec3 x\u00e1c minh \u0111i\u1ec1u \u0111\u00f3 t\u01b0\u01a1ng t\u1ef1 khi c\u1ed1 g\u1eafng truy c\u1eadp m\u00e1y ch\u1ee7 v\u1edbi t\u01b0 c\u00e1ch l\u00e0 ng\u01b0\u1eddi&nbsp;<code>root<\/code>d\u00f9ng:<\/p>\n<pre class=\"wp-block-code\"><code>ssh root@192.0.2.17<\/code><\/pre>\n<p>\u0110\u1ec3 x\u00e1c minh chi ti\u1ebft h\u01a1n, b\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng l\u1ec7nh&nbsp;<code>getent<\/code>v\u00e0&nbsp;<code>groups<\/code>sau khi \u0111\u00e3 \u0111\u0103ng nh\u1eadp v\u00e0o m\u00e1y ch\u1ee7. L\u1ec7nh tr\u01b0\u1edbc, \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng v\u1edbi t\u00f9y&nbsp;<code>passwd<\/code>ch\u1ecdn v\u00e0 t\u00ean ng\u01b0\u1eddi d\u00f9ng, cung c\u1ea5p t\u00f3m t\u1eaft th\u00f4ng tin chi ti\u1ebft c\u1ee7a ng\u01b0\u1eddi d\u00f9ng tr\u00ean h\u1ec7 th\u1ed1ng.<\/p>\n<p>Trong v\u00ed d\u1ee5 n\u00e0y, b\u1ea1n c\u00f3 th\u1ec3 th\u1ea5y m\u1ee5c nh\u1eadp&nbsp;<code>example-user<\/code>c\u00f3 ch\u00fa th\u00edch GECOS, th\u01b0 m\u1ee5c g\u1ed1c v\u00e0 ch\u01b0\u01a1ng tr\u00ecnh shell \u0111\u01b0\u1ee3c ch\u1ec9 \u0111\u1ecbnh:<\/p>\n<pre class=\"wp-block-code\"><code>sudo getent passwd example-user<\/code><\/pre>\n<pre class=\"wp-block-code\"><code>example-user:x:1000:1002:Example User,600-700-8090:\/home\/example-user:\/bin\/bash<\/code><\/pre>\n<p>Nh\u1eefng g\u00ec c\u00f2n thi\u1ebfu \u1edf tr\u00ean l\u00e0 x\u00e1c minh nh\u00f3m ng\u01b0\u1eddi d\u00f9ng. B\u1ea1n c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n \u0111i\u1ec1u \u0111\u00f3 b\u1eb1ng l\u1ec7nh theo&nbsp;<code>groups<\/code>sau l\u00e0 t\u00ean ng\u01b0\u1eddi d\u00f9ng. V\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi th\u1ef1c hi\u1ec7n \u0111i\u1ec1u n\u00e0y cho&nbsp;<code>example-user<\/code>, cho th\u1ea5y ng\u01b0\u1eddi d\u00f9ng thu\u1ed9c v\u1ec1 m\u1ed9t nh\u00f3m ng\u01b0\u1eddi d\u00f9ng t\u1ef1 \u0111\u1eb7t t\u00ean c\u00f9ng v\u1edbi&nbsp;<code>example-group<\/code>.<\/p>\n<pre class=\"wp-block-code\"><code>sudo groups example-user<\/code><\/pre>\n<pre class=\"wp-block-code\"><code>example-user : example-user sudo example-group<\/code><\/pre>\n<h2 id=\"more-information\">Th\u00f4ng tin th\u00eam<\/h2>\n<p>B\u1ea1n c\u00f3 th\u1ec3 mu\u1ed1n tham kh\u1ea3o c\u00e1c ngu\u1ed3n sau \u0111\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 ch\u1ee7 \u0111\u1ec1 n\u00e0y. M\u1eb7c d\u00f9 ch\u00fang t\u00f4i cung c\u1ea5p v\u1edbi hy v\u1ecdng r\u1eb1ng ch\u00fang s\u1ebd h\u1eefu \u00edch, nh\u01b0ng xin l\u01b0u \u00fd r\u1eb1ng ch\u00fang t\u00f4i kh\u00f4ng th\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh ch\u00ednh x\u00e1c ho\u1eb7c t\u00ednh k\u1ecbp th\u1eddi c\u1ee7a c\u00e1c t\u00e0i li\u1ec7u \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef b\u00ean ngo\u00e0i.<\/p>\n<ul>\n<li><a href=\"https:\/\/cloudinit.readthedocs.io\/en\/latest\/reference\/modules.html#users-and-groups\" target=\"_blank\" rel=\"noreferrer noopener\">T\u00e0i li\u1ec7u Cloud-init &#8211; Tham chi\u1ebfu m\u00f4-\u0111un: Ng\u01b0\u1eddi d\u00f9ng v\u00e0 Nh\u00f3m<\/a><\/li>\n<\/ul>\n<p>Ngu\u1ed3n: https:\/\/www.linode.com\/docs\/guides\/manage-users-with-cloud-init\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cloud-init&nbsp;l\u00e0 gi\u1ea3i ph\u00e1p ti\u00eau chu\u1ea9n c\u00f4ng nghi\u1ec7p \u0111\u1ec3 t\u1ef1 \u0111\u1ed9ng h\u00f3a vi\u1ec7c tri\u1ec3n khai m\u00e1y ch\u1ee7, h\u1ed7 tr\u1ee3 tr\u00ean nhi\u1ec1u n\u1ec1n t\u1ea3ng v\u00e0 b\u1ea3n ph\u00e2n ph\u1ed1i. K\u1ebft h\u1ee3p si\u00eau d\u1eef li\u1ec7u n\u1ec1n t\u1ea3ng v\u1edbi c\u00e1c t\u1eadp l\u1ec7nh d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng t\u00f9y ch\u1ec9nh, cloud-init c\u00f3 th\u1ec3 \u0111\u01a1n gi\u1ea3n h\u00f3a \u0111\u00e1ng k\u1ec3 qu\u00e1 tr\u00ecnh kh\u1edfi t\u1ea1o<\/p>\n","protected":false},"author":1,"featured_media":35979,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[132],"tags":[],"class_list":["post-34958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-init"],"_links":{"self":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/posts\/34958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/comments?post=34958"}],"version-history":[{"count":0,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/posts\/34958\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/media\/35979"}],"wp:attachment":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/media?parent=34958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/categories?post=34958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/tags?post=34958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}