topic User creation in Operating System - HP-UX

User creation

Karthik S S — Fri, 21 Feb 2003 05:38:03 GMT

Hi,

I would like to create a user who should be able to control all others user's home directories should be able to create/delete/modify contents of the other user's files/directories. How can I accomplish this??. But, that user should not have any special privileges on other directories than /home.

Pl. help.

Thanks
Karthik

Re: User creation

Sridhar Bhaskarla — Fri, 21 Feb 2003 05:43:54 GMT

Hi Karthik,

SUDO is ideal for you. It is easy to setup and install. You can get sudo from HP's porting site.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/

More information including FAQ is available at

http://www.courtesan.com

You will have to manipulate sudoers configuration file to achieve what you need.

-Sri

Re: User creation

RAC_1 — Fri, 21 Feb 2003 05:46:09 GMT

You can use sudo(Superuser do) utility.

With this you can give waht commands a user can run.

Re: User creation

Rajeev Shukla — Fri, 21 Feb 2003 05:49:45 GMT

Create any user and give him restricted SAM access. Give him only user administration and dont give anything else.

then he can delete, add and modify users

Re: User creation

T G Manikandan — Fri, 21 Feb 2003 05:50:21 GMT

Another thing I would suggested is
having a restricted SAM account.
Do a sam -r from root

#sam -r

Give the requied file access permissions to the user you are planning to.

Thanks

Re: User creation

Ravi_8 — Fri, 21 Feb 2003 05:51:18 GMT

Hi karthik,

sudo is the best suit for this operation as said by Sri

Re: User creation

Michael Tully — Fri, 21 Feb 2003 07:37:37 GMT

You will need to set up sudo, as suggested. You could make changes to the directory permissions and create a group that controls it with permissions of 775.

you can't really use a restricted 'sam' as it is captive. You won't be able to modify directory/file conetents from there.

Re: User creation

T G Manikandan — Fri, 21 Feb 2003 07:44:05 GMT

Also there would be other way like using ACL's
If you have JFS3.3 version then you can use them.

MOst prefer sudo,then that should be the right choice.

Thanks

Re: User creation

Systeemingenieurs Infoc — Fri, 21 Feb 2003 08:23:32 GMT

I'm not sure about sudo. How can u accomplish access to all homedir-files and no other files ?

Re: User creation

Karthik S S — Fri, 21 Feb 2003 11:53:33 GMT

Yeah .. I agree with you. Could any one suggest me how do I set the user and command alias to accomplish the required task? (i.e. the user should have full access only on /home)..

Thanks
Karthik

Re: User creation

Pete Randall — Fri, 21 Feb 2003 11:59:00 GMT

I agree, Karthik. Sudo, in this case is "nodo". It won't accomplish what you want. Michael's suggestion about creating a controlling group that would have access to /home/* would seem to be the most likely solution.

Pete

Re: User creation

Karthik S S — Fri, 21 Feb 2003 12:19:14 GMT

Hi,

But even if I create a group with 775 permissions for /home/* if a user creates a file with 077 permission then that group owner cant do anything about it right??. I am more confused now :-(

Pl. help

Thanks
Karthik

Re: User creation

Pete Randall — Fri, 21 Feb 2003 12:22:55 GMT

Sorry, Karthik, I mis-read Michael's post. He's suggesting a combination of sudo and group permissions and I'm not sure quite how that would work.

I'm as confused as you now.

Pete

Re: User creation

Karthik S S — Fri, 21 Feb 2003 13:17:03 GMT

Hi

I found some workaround for this task. i.e giving a particular user the "su" access to login as other user save root.

Host_Alias SERVERS=host1

suhome SERVERS=/bin/su ?*,!/bin/su root,!/bin/su - root

The user suhome will be able to login as any other user in the system but not as root. But this still may have some security risk. Could anyone suggest me if there are some other ways to do it??

Thanks
Karthik

Re: User creation

Systeemingenieurs Infoc — Fri, 21 Feb 2003 13:27:22 GMT

I see 2 solutions :

1. write scripts for every functionality u want to give tot the admin : create dir, rempove dir, ... (no vi plz). Then let him execute the scripts via sudo.

2. use samba : create a service for /home and allow you admin to map it on his windoz. He'll be able to mess around with the files at will. 1 thing : do a "force user=root" (i hope that's a good idea, but at first sight it is).