topic Re: ID to run specific command in Operating System - HP-UX

ID to run specific command

so.nimda — Wed, 23 Apr 2008 01:43:35 GMT

Hi,

I have a junior administrator whom I would like him to do some specific OS task.

I do not want to grant him root access and assigning UID 0 is a definite no.

I have read in posts here that "sudo" can be used, but wouldn't that also allow commands like "rm *.*" to be executed also?

Is there a way for me to only limit his access to certain specific commands like, for example, "lpstat"?

Thanks in advance.

Re: ID to run specific command

Jeeshan — Wed, 23 Apr 2008 01:55:18 GMT

Hi

Do you heard about ACL?

May be this way can help you.

Re: ID to run specific command

so.nimda — Wed, 23 Apr 2008 02:11:58 GMT

Hi ahsan,

Could you care to elaborate on ACL?

How do I implement it?

Thanks

Re: ID to run specific command

Jeeshan — Wed, 23 Apr 2008 02:23:38 GMT

Hi again

read this

http://docs.hp.com/en/5992-2146/ch09s05.html

Re: ID to run specific command

Kapil Jha — Wed, 23 Apr 2008 02:35:55 GMT

If you or your management have hired him , i suppose you have to believe in him.
Nobody is crazy to fire rm * on a system if he has worked on UNIX.
Just ask him to take care while working then he would be more productive.
If you want him to run only a coulple of command try ACL as said by Ahsan or you have use restricted shell and copy some of basic command (if they are very few) in his shell.
BR,
Kapil

Re: ID to run specific command

so.nimda — Wed, 23 Apr 2008 02:38:11 GMT

Thanks for the link.

I have read it and it seems that it's for SD (software distribution).

How do I go about implementing it for OS command like "lpstat", or "ls"?

Thanks

Re: ID to run specific command

so.nimda — Wed, 23 Apr 2008 02:50:44 GMT

Hi Kapil,

Thanks for your reply.

It's just a precaution that I would like to take as he fresh with zero unix knowledge.

"Nobody is crazy to fire rm * on a system if he has worked on UNIX"? Fact is - he has never worked in a unix environment.

Anyway, as I only need him to perform specific tasks, removing other access would seem more practical than asking him to be careful, as even experience administrators do sometimes make mistakes, too. ;)

Re: ID to run specific command

Kapil Jha — Wed, 23 Apr 2008 02:56:48 GMT

thats OK if he does not have any UNIX exp.
well from the beginning u seens to be intersted in lpstat command.
You can copy this command in this home directory....and it will work for him....
BR,
Kapil

Re: ID to run specific command

Jeeshan — Wed, 23 Apr 2008 03:24:15 GMT

Hi

may be this can help you briefly

http://docs.hp.com/en/B2355-90950/ch08s04.html

You may consider another thing. Give him a account with restricted shell and copy the commands he need to do his job.

Re: ID to run specific command

so.nimda — Wed, 23 Apr 2008 04:03:32 GMT

Thanks, ahsan & Kapil

Will explore the shell alternative for him.

Regards

Re: ID to run specific command

Dennis Handly — Wed, 23 Apr 2008 08:21:56 GMT

>Is there a way for me to only limit his access to certain specific commands like, for example, lpstat?

Yes, you can limit commands to sudo.
There is also HP's RBAC. See these links:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1215907
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1206541
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1204720

Re: ID to run specific command

Yogeeraj_1 — Wed, 23 Apr 2008 08:57:25 GMT

hi,

you may also wish to write a simple menu driven application that allows him to run the restrictive commands.

In this case, he won't even need to know the command that would be run in the background.

Indeed, SUDO will be the tool of choice in any cases.

kind regards
yogeeraj

Re: ID to run specific command

Ron Irving — Wed, 23 Apr 2008 11:46:59 GMT

Once he has a little experience, turn him on to this forum. There is a wealth of knowledge here.