topic Re: Duplicate root account. in Operating System - HP-UX

Duplicate root account.

bullz — Thu, 18 Mar 2010 15:45:53 GMT

Hello Guruz,

I want to create a duplicate root account, but ter is a restriction for duplication of uid 0

Then I thought of installing sudo, but that option also not accepted.

Just would like to know if any can advise, how can I get the root access for normal account.

Note: points will be equally shared :)

Re: Duplicate root account.

Patrick Wallek — Thu, 18 Mar 2010 15:49:22 GMT

It is not advised to have more than one UID 0 account. That is a VERY BIG security hole.

>>Then I thought of installing sudo, but that option also not accepted.

Sudo is the best way to grant normal users root access. Why was it not accepted?

Re: Duplicate root account.

James R. Ferguson — Thu, 18 Mar 2010 15:56:27 GMT

Hi:

Do *not* create duplicate uid=0 accounts.

You can, and then if you forget (or your successor forgets) and does something (stupid) like this (where user 'bullz' has a uid=0):

/* DO NOT DO THIS !!! */

# find /path -user bullz -exec rm -rf {} +

...then you just *removed* all of 'root's files and directories!

Regards!

...JRF...

Re: Duplicate root account.

bullz — Thu, 18 Mar 2010 16:03:13 GMT

Thanks for you view on this, any other s/w or tool availbe just like SUDO? i want this kind of setup on HP-UX / Linux and Solaris servers too :)

waiting for good news.

Re: Duplicate root account.

Pete Randall — Thu, 18 Mar 2010 16:26:33 GMT

Check the official sudo site:

http://www.gratisoft.us/sudo/intro.html

for installation requirements and supported environments.

Pete

Re: Duplicate root account.

Pete Randall — Thu, 18 Mar 2010 16:36:53 GMT

I suppose I could have just told you that its available for AIX, RedHat Linux, IRIX and Solaris but you really ought to try this new thing called Google. Quite handy.

Pete

Re: Duplicate root account.

Steven E. Protter — Thu, 18 Mar 2010 16:49:12 GMT

Shalom,

A few views:

Now, Dana Corp. Only security department has the root password, no duplicate root accounts are permitted. We use etrust/seos to elevate the admin users to root privileges but what they can do is limited.

Previous job, NDS Jerusalem. They chose to go the duplicate uid=0 root. The primary reason was to know who did what. I was rootp(prottever) rootv was my boss Victor, etc etc.

Is it really a security hole to have multiple uid=0 accounts? Classical response which you already have is yes. But it was manageable since only qualified systems administrators had the password. Though password reset involved a meeting.

Prior to that only systems administrator, my backup(a dba eeek!) and operations had root.

I fought operators having root and proposed sudo and was overruled.

SEP

Re: Duplicate root account.

Johnson Punniyalingam — Thu, 18 Mar 2010 17:02:19 GMT

>>>Thanks for you view on this, any other s/w or tool availbe just like SUDO? i want this kind of setup on HP-UX<<<

"Power broker" software which is similar software like sudo for HP,

Difference between Power broker & Sudo explained in below thread

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=956140

Hope for >> AX, RedHat Linux, IRIX and Solaris<< -> SUDO would best approach, if not better to ask "Google" any third party SW available

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1268935173924+28353475&threadId=1084893

Re: Duplicate root account.

Rick Garland — Thu, 18 Mar 2010 17:22:24 GMT

Another option to look at is called 'rootsh'. Works in conjunction with sudo and provides lots of logging. Can find on the net, there are HPUX binaries available as well.

Can give you the best of both worlds. The logging of sudo to see who invoke a rootsh plus the logging of rootsh to provide you with the data you want plus the capabilities of a UID=0 user without duplicating.

Re: Duplicate root account.

Rick Garland — Thu, 18 Mar 2010 17:31:48 GMT

And BTW, rootsh will work on AIX, Solaris, Linux, HPUX, etc...

Re: Duplicate root account.

Tingli — Thu, 18 Mar 2010 17:42:49 GMT

Take a look at man sudoers, there might be something to help you.

Re: Duplicate root account.

Raj D. — Thu, 18 Mar 2010 18:33:59 GMT

Bullz,

Yes, you can create duplicate root id, with -o option with useradd command.
#useradd -u 0 -o ..... -m /home/root1 root1

http://docs.hp.com/en/B2355-60105/useradd.1M.html

However it is wise to use sudo , and that way system will be secure and access can be delegated properly.

There is another good software available ($$) for access control is powerbroker and can be used for wide range of unix systems including linux:

http://www.beyondtrust.com/products/pbreviews.asp

HTH,
Raj.

Re: Duplicate root account.

Dennis Handly — Fri, 19 Mar 2010 03:34:59 GMT

If you don't want sudo, there is HP's RBAC:
https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=AccessControl

Re: Duplicate root account.

bullz — Fri, 19 Mar 2010 09:30:26 GMT

Folks,

I really appreciate the replies which you all sent.
Still points need to be assigned for ROOTSH posts. I do that shortly.

Major challenge here is, can I get a root access ( eventually I should login as root ) for normal user without below options.

â ¢ There shouldnâ t be any duplicate UID of 0 (zero)
â ¢ SUDO also strictly restricted for some reason

I got an advice to install ROOTSH, but my question here is, will it work without SUDO?
Also, will it work on Linux, and solaris too?