topic Re: SUDO help in Operating System - HP-UX

SUDO help

Sajjad Ali_1 — Tue, 08 Mar 2005 12:04:58 GMT

Hi,

I am looking for some help with sudo. I have a script process.sh owned by user TESTA and permission 744. process.sh needs TESTA's environment variables set in .profile for successful run.

I've configured SUDO, so that user TESTB can run process.sh and pick up environment settings of TESTA. But it's not picking up the env variables, in other words, it's not executing TESTA's profile at runtime. How can I make it execute the profile before running the script? I am running this as TESTB: sudo -u TESTA /home/TESTA/process.sh

Host_Alias SVR = HP1
User_Alias ADMIN = TESTB
Cmnd_Alias SCRIPTS = /home/TESTA/process.sh

ADMIN SVR = (TESTA) SCRIPTS

Thanks for your help in advance.

SA

Re: SUDO help

RAC_1 — Tue, 08 Mar 2005 12:11:35 GMT

sudo wont run the .profile of that user. you will have to define all required variables in process.sh.

Anil

Re: SUDO help

Sajjad Ali_1 — Wed, 09 Mar 2005 16:33:08 GMT

Okay, Thanks Anil,
One more question about SUDO. How do I allow certain users to SU to only prod1 user but not anyone else?

Host_Alias SVR = HP1
User_Alias ADMIN = joe
Cmnd_Alias SU= /usr/bin/su

ADMIN SVR = (prod1) SU, !root (is this the right systax?)

Thanks again.

Re: SUDO help

Patrick Wallek — Wed, 09 Mar 2005 16:49:31 GMT

I would set up the specific su command that they are allowed to use.

Cmnd_Alias SUPROD1=/usr/bin/su - prod1

Then for the user:

ADMIN SVR=SUPROD1

This way if the user enters something other than the above command, they will get an error. If you just have a few su's that you need to allow, this is relatively easy.

Re: SUDO help

Sajjad Ali_1 — Wed, 09 Mar 2005 17:06:13 GMT

One additional question, would that SUDO policy work if I remove the setuid from /usr/bin/su or make it only executable by root? How do I allow only the ADMIN group to be able to su to root without password? Thanks again.

Re: SUDO help

Jannik — Wed, 09 Mar 2005 17:31:29 GMT

but the su command will.. try this:
sudo su - TESTA -c '/home/TESTA/process.sh'

Re: SUDO help

Mark Nieuwboer — Thu, 10 Mar 2005 04:34:13 GMT

Sajjad,

When you put su- in sudo you are wasting sudo. When persons needs to su - to another user let them fill in the password of the user.