topic Re: Executing command from script as root. in Operating System - HP-UX

Executing command from script as root.

Thomas Amwoza — Tue, 29 Aug 2000 02:50:01 GMT

I am having a problem with the chown/chgrp
commands on NFS file systems. Apparently,
only root can do it correctly.

As a result I have written a script that is
executing the chown/chgrp commands using the
following syntax:

su root -c "/usr/bin/chown -R : //"

Is there a way to have this script execute
the command without prompting for a password?

Re: Executing command from script as root.

RikTytgat — Tue, 29 Aug 2000 04:42:30 GMT

Hi,

Actually it's root and the owner of a file that can change the permissions on a file.

No, there is no way to do what you want without providing a password.

Apparently, you map the root user to root by using the 'root=....' option in your /etc/exports file. This is not so good from a security point of view. The default behaviour for NFS is to map the root user to user 65534.

Maybe you can describe exactly why you have to chmod/chgrp those files. Maybe there is a way to prevent you from having to do it.

Bye,
Rik.

Re: Executing command from script as root.

Antoanetta Naghiu — Tue, 29 Aug 2000 05:19:42 GMT

No, it is no way to su to root without providing the password. See as well:
http://my1.itrc.hp.com/cm/QuestionAnswer/1,1150,0x1dbb119c3420d411b66300108302854d,00.html

But, your case doesn't seem to be ok. What file system are you importing? How the export line in /etc/exports looks like?

You can try to enable SUID bit (s permission) if you like and security is not a concern

Re: Executing command from script as root.

Victor BERRIDGE — Tue, 29 Aug 2000 08:08:01 GMT

If you want to su -c root without passwd asked the safest way is to install and configure sudo, you can dowload a version at your archive and porting center.
There are other alternatives but they are security breeches...
On which machine are you trying to chown?

On the importing NFS FS ?

Re: Executing command from script as root.

Rick Garland — Tue, 29 Aug 2000 12:22:10 GMT

You are probably looking at the use of sudo if you want the script to run as root with no passwd. Can be obtained from the porting archieves or from www.courtesan.com

Re: Executing command from script as root.

Vince Inman — Tue, 29 Aug 2000 13:31:45 GMT

A would advocate using sudo for this purpose.
Sudo provides a number advantages. Auditing, containability, and flexibility are the main advantages to using sudo.

Re: Executing command from script as root.

Richard Henriques — Tue, 29 Aug 2000 16:40:50 GMT

Instead of su, have you considered increasing the privileges of user executing the script? You can use setprivgrp(1M) to allow a user to change the ownership of a file that the user owns.

Re: Executing command from script as root.

Bruno Dostie — Wed, 30 Aug 2000 15:02:52 GMT

I have created a kind of executable file like that some years ago on HP-UX v9

loook at the included "chmodutils" file.
make changes you need,
put yourfile in /usr/sbin directory
chown root yourfile , chgrp sys yourfile
look at man 1m chmod command
probably your solution will be
chmod 4555 yourfile
(set-user-id on file execution)

I wich attached file is well attached, it's first time I do that

Tourlou ;-)
Bruno

Re: Executing command from script as root.

Shannon Petry — Wed, 30 Aug 2000 19:17:04 GMT

I think that your problem is not fixable at the level you are trying to do. The NFS server is where this script should run. You are running this on an NFS client. If you must run this from an NFS client, then the client must be specified with root access in the servers export list. There are several ways to have this done in at least a semi-secure fashion. Best to read the man pages for exportfs, but you want several things.
> exportfs /directory -root=client1,anon=0,rw=host1:host2:host3,ro=host4:host5
This restricts access to known hosts. You can also use an "access=netgroup" for read-write access.
If root is specified in the exports file, your problem is solved. While I use sudo for several tasks, I would not use sudo for this task. This gives that user(s) global access then to chmod, chown, chgrp anything. It is a root level task, which should really be done by root's cron on the server.
I have the same task running on one of my servers. The only other thing to mention of this is LOG LOG LOG. (should go without saying).

Best Regards,
Shannon