topic Re: Create new user with root privileges in Operating System - HP-UX

Create new user with root privileges

maxell_1 — Mon, 11 Aug 2008 15:49:57 GMT

Hi Guys,

I do not wish to use the default root user due to security reasons and thus trying to create a new user with root privileges to do my admin tasks.

What is the appropriate useradd command options to use in order to do this. The username I wish to use is "admin".

Thanks

Re: Create new user with root privileges

candlejack — Mon, 11 Aug 2008 15:54:15 GMT

Hi,

There's really no such thing as "root privileges," but you can obtain what you are looking for mostly by assigning many secondary groups to your "admin" user.

Re: Create new user with root privileges

Court Campbell — Mon, 11 Aug 2008 15:57:29 GMT

Implement sudo.

Re: Create new user with root privileges

Tim Nelson — Mon, 11 Aug 2008 15:58:58 GMT

>>I do not wish to use the default root user due to security reasons and thus trying to create a new user with root privileges to do my admin tasks

If you create another user with root privelages it negates any security concerns because that user can then do anything that root can do...

If you wish to only give "some" privelages to another user then either sudo or restricted SAM is the way to go.

Again, if you wish to create another username with complete "root" privs then you might as well just give them the root password.

Re: Create new user with root privileges

maxell_1 — Mon, 11 Aug 2008 15:59:16 GMT

Not really totally becoming root actually.

Rather my intention is to allow this new user to be able to perform tasks and execute commands pertaining to Network configuration and troubleshooting, DNS configuration, Backup as well as NFS.

Do i really need to assign this new user a user ID of 0?

Re: Create new user with root privileges

James R. Ferguson — Mon, 11 Aug 2008 16:10:22 GMT

Hi:

The 'root' user is *any* user with a uid=0.

Do *not* have multiple user accounts with uid=0. Not only is this a great security risk, but it is dangerous for the following reason:

# find / -user someuser -exec rm -rf {} \+

...you *thought* you were cleaning up "someuser" but when its uid=0, you just removed 'root's files and directories!

Using 'sudo' is the most appropriate, safe way to do what you want.

Regards!

...JRF...

Re: Create new user with root privileges

Court Campbell — Mon, 11 Aug 2008 16:11:44 GMT

No, install sudo.

Re: Create new user with root privileges

maxell_1 — Mon, 11 Aug 2008 23:20:07 GMT

Alright, I will try to use sudo. Thanks everybody for your valuable advice :)

Re: Create new user with root privileges

Steven E. Protter — Tue, 12 Aug 2008 00:19:09 GMT

Shalom,

sudo is available from http://software.hp.com as part of Internet Express.

Search for it and you can choose to download sudo alone.

This will include all dependencies which the version from the Porting and Archive Center make you do for yourself.

sudo is the way to go.

SEP

Re: Create new user with root privileges

Safarali — Tue, 12 Aug 2008 02:55:56 GMT

Hi Samuel sudo is the best practise you can monitor the activities if you are only want cetrain task then better to go restricted sam builder so user can only do the certain task

Regards
Safar

Re: Create new user with root privileges

Asif Sharif — Tue, 12 Aug 2008 03:36:53 GMT

Good day smauel,

HP-UX RBAC is an alternative to the traditional "all-or-nothing" root user model, which grants permissions to the root user for all operations, and denies permissions to non-root users for certain operations. HP-UX RBAC allows you to distribute administrative responsibilities by creating roles with appropriate authorizations and assigning them to non-root users and groups.

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=A
ccessControl

http://docs.hp.com/en/5992-2395/ch05s05.html

Regards,
Asif Sharif

Re: Create new user with root privileges

Court Campbell — Tue, 12 Aug 2008 16:45:08 GMT

I was going to mention rbac as HP doesn't support sudo, but rbac is a pain to setup and make changes to IMO. Sudo is a lot easier to implement.