topic Re: /etc/default/su in Operating System - HP-UX

/etc/default/su

Tan Cheng Chye — Thu, 02 Mar 2006 02:36:33 GMT

I'm trying to implement a security requirement whereby a non-root user who uses the "su" command will not be prompted to enter root's password so as not to expose root's password to the user but still be able to track the non-root user's usage of the "su" command. I understand that in some Unix OS, this can be accomplished by editing the "/etc/default/su" file and creating a line with the following entry "PROMPT=no". Is this feature available and supported for HP-UX 11.0? If not, is there a way to do this on HP-UX?

Re: /etc/default/su

Devender Khatana — Thu, 02 Mar 2006 02:41:34 GMT

Hi,

An alternative I know is to use sudo for a normal user to achive him doing previledged work. Also on using sudo to do this he will be prompted for his own password rather than root's password.Also this will be very well logged into syslog.log.

Apart from this giving su permission to users is not advisable as after doing su he can do anything. A better option will be to give previledge to user for only required commands using sudo.

HTH,
Devender

Re: /etc/default/su

Arunvijai_4 — Thu, 02 Mar 2006 02:54:15 GMT

Hello,

As far as i know, HP-UX doesn't have /etc/default/su as of Solaris and SCO. For security related features, refer to the /etc/default/security file in the security(4) manual page.

# man su will also provide you more information.

-Arun

Re: /etc/default/su

Tan Cheng Chye — Thu, 02 Mar 2006 21:30:29 GMT

Thanks for the information. I take it that /etc/default/su is not applicable in HP-UX.

/etc/default/security only allows one to configure the parameters SU_ROOT_GROUP, SU_DEFAULT_PATH and SU_KEEP_ENV_VARS pertaining to "su", which does not address my requirement.

Will check out sudo. However, I understand that it's a third party freeware. Is it supported by HP and where can I get a copy for HP-UX 11.0?

Re: /etc/default/su

Arunvijai_4 — Thu, 02 Mar 2006 23:50:28 GMT

Hi,

sudo is part of Internet Express suite which can be downloaded from,

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

Also, from

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.8p12/

Note : This is only for 11.11, not 11.0

You can compile on your own for 11.0

-Arun

Re: /etc/default/su

Mustafa Gulercan — Fri, 03 Mar 2006 02:11:10 GMT

hi;
you may follow these steps;
1-add a wheel group

# groupadd wheel

2-and add which user you wanna allow su - root

#usermod -G wheel

3- edit the /etc/default/security

SU_ROOT_GROUP=wheel

regards,

mustafa