# Linux 建立限制指令的使用者

<span style="color: rgb(0, 0, 0);">**要建立一個限制極高的專用帳號，使其只能執行 `smartctl -a`，最安全且乾淨的做法是利用 Linux 的 SSH Command Restriction (Force Command) 機制，搭配 `sudoers` 最小權限設定。**</span>

<span style="color: rgb(0, 0, 0);">**以下是完整的設定步驟：**</span>

### <span style="color: rgb(0, 0, 0);">**步驟 1：建立受限使用者**</span>

<span style="color: rgb(0, 0, 0);">**在目標 Linux 機器上建立一個專門用於監控的帳號（例如命名為 `smartmon`），並停用密碼登入：**</span>

<span style="color: rgb(0, 0, 0);"></span>

```
# 建立使用者 smartmon，禁用密碼並停用標準 shell
sudo useradd -m -s /bin/bash smartmon

```

<div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-123 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="3" id="bkmrk--1" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-123"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-123"></div></div></div><span style="color: rgb(0, 0, 0);"></span>

### <span style="color: rgb(0, 0, 0);">**步驟 2：設定 `sudoers` 最小權限**</span>

<span style="color: rgb(0, 0, 0);">**`smartctl` 需要 `root` 權限才能存取硬碟底層控制介面。透過 `visudo` 允許 `smartmon` 只能免密碼執行 `smartctl`：**</span>

1. <span style="color: rgb(0, 0, 0);">**開啟 sudo 設定檔：**</span>
    
    <span style="color: rgb(0, 0, 0);"></span><div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-124 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="6" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-124"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-124"></div></div></div>```
    sudo visudo -f /etc/sudoers.d/smartmon
    
    ```
    
    <div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-124 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="6" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-124"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-124"></div></div></div><span style="color: rgb(0, 0, 0);"></span>
2. <span style="color: rgb(0, 0, 0);">**寫入以下內容（嚴格限制只能帶 `-a` 參數，或對所有磁碟裝置放行）：**</span>
    
    <span style="color: rgb(0, 0, 0);"></span><div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-125 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="9" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-125"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-125"><div _ngcontent-ng-c82634607="" class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c82634607-125 ng-star-inserted"><span class="ng-tns-c82634607-125">程式碼片段</span><div _ngcontent-ng-c82634607="" class="buttons ng-tns-c82634607-125 ng-star-inserted"><button aria-label="下載程式碼" class="mdc-icon-button mat-mdc-icon-button mat-mdc-button-base mat-badge mat-unthemed mat-badge-overlap mat-badge-above mat-badge-after mat-badge-small mat-badge-hidden ng-star-inserted"></button><button aria-label="複製代碼" class="mdc-icon-button mat-mdc-icon-button mat-mdc-button-base mat-badge mat-unthemed mat-badge-overlap mat-badge-above mat-badge-after mat-badge-small mat-badge-hidden ng-star-inserted"></button></div></div></div></div></div>```
    # 允許 smartmon 免密碼以 root 權限執行 smartctl -a
    smartmon ALL=(root) NOPASSWD: /usr/sbin/smartctl -a *
    smartmon ALL=(ALL) NOPASSWD: /usr/sbin/smartctl
    
    ```
    
    <div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-125 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="9" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-125"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-125"></div></div></div><span style="color: rgb(0, 0, 0);"></span>

### <span style="color: rgb(0, 0, 0);">**步驟 3：設定 SSH Key 與強制指令 (Force Command)**</span>

<span style="color: rgb(0, 0, 0);">**這是最關鍵的一步。透過 SSH 公鑰中的 `command=` 限制，即使有人取得該公鑰，也絕對無法執行 SSH 互動 Shell 或任何其他指令。**</span>

1. <span style="color: rgb(0, 0, 0);">**建立 `.ssh` 目錄：**</span>
    
    <span style="color: rgb(0, 0, 0);"></span><div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-126 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="12" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-126"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-126"></div></div></div>```
    sudo mkdir -p /home/smartmon/.ssh
    sudo chmod 700 /home/smartmon/.ssh
    
    ```
    
    <div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-126 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="12" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-126"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-126"></div></div></div><span style="color: rgb(0, 0, 0);"></span>
2. <span style="color: rgb(0, 0, 0);">**編輯 `authorized_keys`：**</span>
    
    <span style="color: rgb(0, 0, 0);"></span><div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-127 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="15" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-127"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-127"></div></div></div>```
    sudo nano /home/smartmon/.ssh/authorized_keys
    
    ```
    
    <div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-127 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="15" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-127"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-127"></div></div></div><span style="color: rgb(0, 0, 0);"></span>
3. <span style="color: rgb(0, 0, 0);">**貼上你的公鑰，並在最前端加上限制參數： 在公鑰（例如 `ssh-ed25519 AAAAC3N...`）的最前面加上 `command="..."` 與安全防禦參數：**</span>
    
    <span style="color: rgb(0, 0, 0);"></span><div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-128 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="18" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-128"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-128"></div></div></div>```
    command="sudo /usr/sbin/smartctl -a $SSH_ORIGINAL_COMMAND",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... (公鑰內容)
    
    ```
    
    <div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-128 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="18" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-128"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-128"></div></div></div><span style="color: rgb(0, 0, 0);"></span>> <span style="color: rgb(0, 0, 0);">**說明：**</span>
    > 
    > 
    > - <span style="color: rgb(0, 0, 0);">**`command="..."`：強制 SSH 登入時自動套用 `sudo smartctl`，並傳遞傳進來的參數。**</span>
    > - <span style="color: rgb(0, 0, 0);">**`no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty`：關閉所有 SSH 轉發功能與 PTY 虛擬終端，徹底切斷互動 Shell。**</span>
4. <span style="color: rgb(0, 0, 0);">**調整權限與擁有者：**</span>
    
    <span style="color: rgb(0, 0, 0);"></span><div _ngcontent-ng-c82634607="" class="code-block ng-tns-c82634607-129 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" data-hveid="21" jslog="223238;track:impression,attention;BardVeMetadataKey:W1sicl85Y2U4MzQ5NGU1YmJmY2NjIiwiY183NWYzMDY1ZjNhODAwYmIxIixudWxsLCJyY19mODRiZjg4YjZmZTcwOWU4IixudWxsLG51bGwsInpoIixudWxsLDEsbnVsbCxudWxsLDEsMV1d"><div _ngcontent-ng-c82634607="" class="formatted-code-block-internal-container ng-tns-c82634607-129"><div _ngcontent-ng-c82634607="" class="animated-opacity ng-tns-c82634607-129"></div></div></div>```
    sudo chmod 600 /home/smartmon/.ssh/authorized_keys
    sudo chown -R smartmon:smartmon /home/smartmon/.ssh
    ```

### <span style="color: rgb(0, 0, 0);">**測試驗證**</span>

<span style="color: rgb(0, 0, 0);">**完成後，在中控主機嘗試進行連線測試：**</span>

#### <span style="color: rgb(0, 0, 0);">**1. 正常抓取硬碟 S.M.A.R.T. 資料（應該成功）**</span>

```
ssh smartmon@<目標IP> /dev/sda
```

[![image.png](https://note.homesitetw.com/uploads/images/gallery/2026-10/scaled-1680-/Okfimage.png)](https://note.homesitetw.com/uploads/images/gallery/2026-10/Okfimage.png)