blocks|key|1509084|text|visudo|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1509085|要使用firewalld检查打开的端口，这需要管理特权sudo。|CODE|1509086|这不是一种非常干净的方式，但是您可以用它来编辑sudoers文件，编辑sudoers文件需要管理访问：|1509087|sudo+visudo|1509088|添加此内容并替换USER，您希望授予权限的用户名如下：|1509089|+ALL=(root)+NOPASSWD:+/usr/bin/firewall-cmd+--list-ports|1509090|此授予USER执行firewall-cmd+--list-ports的权限。|1509091|在修改系统配置和授予权限时要小心！|1509092|如何在Firewalld中列出开放端口|1509093|在CentOS7+7中使用firewalld显示开放端口列表|1509094|退出/保存编辑到sudoers文件？|1509095|如何在Linux中编辑Sudoers文件|1509096|如何使用Sudo和Sudoers文件|1509097|setuid|1509098|您可以创建一个使用setuid以提升的权限运行的脚本。|1509099|在shell脚本上使用setuid或setgid位会产生比它解决更多的问题--尤其是安全问题。Some系统(如Linux)甚至不尊重shell脚本上的setuid位，因此创建setuid脚本除了带来安全风险之外，还会造成不必要的可移植性问题。|blockquote|1509100|setuid(2)+-+Linux手册页|1509101|允许外壳脚本上的setuid|1509102|为什么我的setuid根bash+shell脚本不能工作？|1509103|如何使用“setuid”位？|1509104|书写setuid或setgid脚本|1509105|<#>Both解决方案只能谨慎使用，而且要非常小心！|1509106|出于For安全原因，建议使用+firewalld+at或使用+root+<#>user或具有管理权限的用户执行对开放端口的检查。|entityMap|0|LINK|mutability|MUTABLE|url|https://linuxhint.com/list_open_ports_firewalld/|1|https://unix.stackexchange.com/questions/536694/show-list-of-open-ports-using-firewalld-in-centos7|2|https://stackoverflow.com/questions/12736351/exit-save-edit-to-sudoers-file-putty-ssh#:%257E:text=To%2520make%2520changes%2520to%2520sudo%2520from%2520putty%252Fbash%253A%25201,press%2520esc%2520to%2520exit%2520editing%2520mode.%2520Weitere%2520Elemente|3|https://operavps.com/docs/edit-sudoers-file/|4|https://www.hostinger.com/tutorials/sudo-and-the-sudoers-file/|5|https://man7.org/linux/man-pages/man2/setuid.2.html|6|https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts|7|https://stackoverflow.com/questions/33565729/why-do-my-setuid-root-bash-shell-scripts-not-work|8|https://unix.stackexchange.com/questions/543002/how-to-use-the-setuid-bit|9|https://www.oreilly.com/library/view/bash-cookbook/0596526784/ch14s15.html^0|0|6|0|3|9|0|N|7|Z|7|0|0|B|0|8|4|0|0|1K|0|3|4|9|P|0|0|0|J|0|0|0|U|1|0|0|I|2|0|0|K|3|0|0|I|4|0|0|6|0|9|6|0|1B|22|0|0|K|0|K|5|0|0|E|0|E|6|0|0|T|0|T|7|0|0|E|0|E|8|0|0|H|0|H|9|0|0|Q|0|2|C|F|9|P|5|V|4|F|9|V|4^^$0|@$1|2|3|4|5|6|7|2E|8|@$9|2F|A|2G|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|2H|8|@$9|2I|A|2J|B|H]]|D|@]|E|$]]|$1|I|3|J|5|6|7|2K|8|@$9|2L|A|2M|B|H]|$9|2N|A|2O|B|H]]|D|@]|E|$]]|$1|K|3|L|5|6|7|2P|8|@$9|2Q|A|2R|B|H]]|D|@]|E|$]]|$1|M|3|N|5|6|7|2S|8|@$9|2T|A|2U|B|H]]|D|@]|E|$]]|$1|O|3|P|5|6|7|2V|8|@$9|2W|A|2X|B|H]]|D|@]|E|$]]|$1|Q|3|R|5|6|7|2Y|8|@$9|2Z|A|30|B|H]|$9|31|A|32|B|H]]|D|@]|E|$]]|$1|S|3|T|5|6|7|33|8|@]|D|@]|E|$]]|$1|U|3|V|5|6|7|34|8|@]|D|@$9|35|A|36|1|37]]|E|$]]|$1|W|3|X|5|6|7|38|8|@]|D|@$9|39|A|3A|1|3B]]|E|$]]|$1|Y|3|Z|5|6|7|3C|8|@]|D|@$9|3D|A|3E|1|3F]]|E|$]]|$1|10|3|11|5|6|7|3G|8|@]|D|@$9|3H|A|3I|1|3J]]|E|$]]|$1|12|3|13|5|6|7|3K|8|@]|D|@$9|3L|A|3M|1|3N]]|E|$]]|$1|14|3|15|5|6|7|3O|8|@$9|3P|A|3Q|B|C]]|D|@]|E|$]]|$1|16|3|17|5|6|7|3R|8|@$9|3S|A|3T|B|H]]|D|@]|E|$]]|$1|18|3|19|5|1A|7|3U|8|@$9|3V|A|3W|B|C]]|D|@]|E|$]]|$1|1B|3|1C|5|6|7|3X|8|@$9|3Y|A|3Z|B|C]]|D|@$9|40|A|41|1|42]]|E|$]]|$1|1D|3|1E|5|6|7|43|8|@$9|44|A|45|B|C]]|D|@$9|46|A|47|1|48]]|E|$]]|$1|1F|3|1G|5|6|7|49|8|@$9|4A|A|4B|B|C]]|D|@$9|4C|A|4D|1|4E]]|E|$]]|$1|1H|3|1I|5|6|7|4F|8|@$9|4G|A|4H|B|C]]|D|@$9|4I|A|4J|1|4K]]|E|$]]|$1|1J|3|1K|5|6|7|4L|8|@$9|4M|A|4N|B|C]]|D|@$9|4O|A|4P|1|4Q]]|E|$]]|$1|1L|3|1M|5|6|7|4R|8|@$9|4S|A|4T|B|C]]|D|@]|E|$]]|$1|1N|3|1O|5|6|7|4U|8|@$9|4V|A|4W|B|C]|$9|4X|A|4Y|B|C]|$9|4Z|A|50|B|C]|$9|51|A|52|B|C]|$9|53|A|54|B|H]|$9|55|A|56|B|H]]|D|@]|E|$]]]|1P|$1Q|$5|1R|1S|1T|E|$1U|1V]]|1W|$5|1R|1S|1T|E|$1U|1X]]|1Y|$5|1R|1S|1T|E|$1U|1Z]]|20|$5|1R|1S|1T|E|$1U|21]]|22|$5|1R|1S|1T|E|$1U|23]]|24|$5|1R|1S|1T|E|$1U|25]]|26|$5|1R|1S|1T|E|$1U|27]]|28|$5|1R|1S|1T|E|$1U|29]]|2A|$5|1R|1S|1T|E|$1U|2B]]|2C|$5|1R|1S|1T|E|$1U|2D]]]]

visudo
To check open ports with <code>firewalld</code> this requires administrative privileges sudo.
That's not the very clean way, but you can edit the <code>sudoers</code> file with, edit the <code>sudoers</code> file requires administrative access:
<code>sudo visudo</code>
Add this and replace <code>USER</code> wuth the username you wanna grant permissions:
<code>&lt;USER&gt; ALL=(root) NOPASSWD: /usr/bin/firewall-cmd --list-ports</code>
This grant the <code>USER</code> permission to execute the <code>firewall-cmd --list-ports</code>.
It is important to caution when modifying system configurations and granting permissions!
<a href="https://linuxhint.com/list_open_ports_firewalld/" rel="noreferrer">How to List Open Ports in Firewalld</a>
<a href="https://unix.stackexchange.com/questions/536694/show-list-of-open-ports-using-firewalld-in-centos7">Show list of open ports using firewalld in CentOS7</a>
<a href="https://stackoverflow.com/questions/12736351/exit-save-edit-to-sudoers-file-putty-ssh#:%7E:text=To%20make%20changes%20to%20sudo%20from%20putty%2Fbash%3A%201,press%20esc%20to%20exit%20editing%20mode.%20Weitere%20Elemente">Exit/save edit to sudoers file?</a>
<a href="https://operavps.com/docs/edit-sudoers-file/" rel="noreferrer">How to Edit Sudoers File in Linux</a>
<a href="https://www.hostinger.com/tutorials/sudo-and-the-sudoers-file/" rel="noreferrer">How to Use Sudo and the Sudoers File</a>
setuid
You can create a script that runs with elevated privileges with <code>setuid</code>.
<blockquote>
Using the setuid or setgid bit on a shell script will create more problems—especially security problems—than it solves. Some systems (such as Linux) don’t even honor the setuid bit on shell scripts, so creating setuid shell scripts creates an unnecessary portability problem in addition to the security risks.
</blockquote>
<a href="https://man7.org/linux/man-pages/man2/setuid.2.html" rel="noreferrer">setuid(2) — Linux manual page</a>
<a href="https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts">Allow setuid on shell scripts</a>
<a href="https://stackoverflow.com/questions/33565729/why-do-my-setuid-root-bash-shell-scripts-not-work">Why do my setuid root bash shell scripts not work?</a>
<a href="https://unix.stackexchange.com/questions/543002/how-to-use-the-setuid-bit">How to use the &quot;setuid&quot; bit?</a>
<a href="https://www.oreilly.com/library/view/bash-cookbook/0596526784/ch14s15.html" rel="noreferrer">Writing setuid or setgid Scripts</a>
Both solutions should only be used with caution and with the greatest care!
For security reasons, it is recommended to perform the check for open ports with <code>firewalld</code> at the end using either the <code>root</code> user or a user with administrative rights.

I noticed that even checking the status of <code>firewalld</code> seems to require <code>sudo</code>. I want to keep the privileges of this script as low as possible and, for that reason, I would like the user to be able to check the port status as a regular user. If necessary, they can then request escalation to <code>sudo</code>.
Is it possible to achieve this on a RHEL-based system, or do you need to be <code>sudo</code> for all of it?

Is there a way to check the ports that are open in firewalld without sudo?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我注意到，即使是检查firewalld的状态似乎也需要sudo。我希望保持这个脚本的特权尽可能低，因此，我希望用户能够检查端口状态作为一个常规用户。如果有必要，他们可以请求升级到sudo。是否有可能在基于RHEL的系统上实现这一目标，或者您是否需要成为所有的sudo？

问有没有办法检查在没有sudo的情况下在firewalld中打开的端口？
EN

回答 1

Unix & Linux用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问有没有办法检查在没有sudo的情况下在firewalld中打开的端口？EN