topic Re: sudo with limited permission in Operating System - HP-UX

sudo with limited permission

tom quach_1 — Tue, 20 Dec 2005 05:29:57 GMT

Hi All,

Would like to have your advices on sudo issue.
how can i assign full control of a printer for a user or group of users by using sudo.
if i assign command lpfence using sudo for a user. Is there a way to only allow him to control only his printers. lpfence involves with shuting down the spooler (lpshut).
Please advice!
Regards,
Tom

Re: sudo with limited permission

RAC_1 — Tue, 20 Dec 2005 05:42:41 GMT

Does all users belong to one single group?
then,
cmnd_alias lp_commands=/usr/sbin/lpfence, lpshut, xxyc, ereette
%group_name ALL=lp_commands

This would give all users in group_name access to all commands that you specify for alis lp_commands.

Re: sudo with limited permission

Jesús Couto Fandiño — Tue, 20 Dec 2005 06:25:18 GMT

Bit tedious, but you can define the command for each user, and add to the command the argument for the printer. That is, instead of defining a alias for the printer commands and assigning it to a group, you have to define 1 line per user & printer :

jcouto ALL = (root) /usr/sbin/lpfence coutoprinter

now I could call sudo /usr/sbin/lpfence coutprinter 10 BUT sudo would not let me do the lpfence for any other printer.

Re: sudo with limited permission

Bill Hassell — Tue, 20 Dec 2005 08:53:11 GMT

The lp user has permission to run the lp commands but I suspect that you don't want the helpers to use *every* lp command. In the sudoers file, you can enumerate each of the allowed commands. The usual commands would be lpadmin (but you may need to limit the options in case a helper accidently deletes a printer), cancel, accept, reject. The good news is that you only need to create the sudo user once with all the needed commands.

Re: sudo with limited permission

tom quach_1 — Sat, 24 Dec 2005 07:12:48 GMT

Thanks- Rac, Jesu', Bill for your help.

this line in my sudoers file works fine
tom ALL = NOPASSWD:/usr/bin/cancel
but if i added a printer name "printer1" at the end, sudo will prompt for a password.
tom ALL = NOPASSWD:/usr/bin/cancel printer1
or even i used command from jesu'
tom ALL = (root)/usr/bin/cancel printer1

it still asks for a password.

is there a way for sudo to assign certain permission for certain user to take of certain task.
ex:cancel command to allow users to canccel only printers assign to him in sudoers file or assign kill command and only allow him to kill processes in his group.

Regards,
Tom