topic Re: setup sudo on HP-UX in Operating System - HP-UX

setup sudo on HP-UX

dgizaw — Thu, 02 Feb 2006 11:27:02 GMT

I am trying to setup a sudo for users to have privilage of creating account . I did the following :
#User alias specification
User_Alias PRESIDE = admin
#Cmd Alias spec
Cmd_alias ADDUSER = /lhome/root/au, /usr/bin/passwd,/usr/bin/chown, /usr/sbin/useradd, /tcb/files/auth/*

#user privilages spec
PRESIDE ALL = NOPASSWD: ADDUSER

when I try to excute /opt/sudo/bin/sudo /lhome/root/au

I am getting : Password cannot be changed, Reason: cannont access protected password entry.

Can you help?

Thank you

Re: setup sudo on HP-UX

Paul F. Carlson — Thu, 02 Feb 2006 11:58:36 GMT

Your command alias is incorrect.

Cmd_Alias ADDUSER=/usr/sbin/useradd

Then when you run sudo as user "admin":

/opt/sudo/bin/sudo /usr/sbin/useradd [options]

Re: setup sudo on HP-UX

Indrajit_1 — Thu, 02 Feb 2006 12:16:40 GMT

Hi;

Try this

#visudo

User_Alias PRESIDE = admin

Cmd_Alias USERADD=/usr/sbin/useradd

Cmd_Alias PASSWD=/usr/bin/passwd

#sudo /usr/sbin/useradd
#sudo /usr/bin/passwd

Cheers
Indrajit

Re: setup sudo on HP-UX

dgizaw — Thu, 02 Feb 2006 17:38:56 GMT

Thank you for your immediate response. I was out some palce. Sorry for that. su to admin helped. and also modified as both of you told me. the only problem now is accessing /tcb/files/auth/[a-z]/*

How do I put it?

PRESIDE ALL = NOPASSWD: /tcb/files/auth/[a-z]/*

Thanks
Daniel

Re: setup sudo on HP-UX

Paul F. Carlson — Fri, 03 Feb 2006 11:28:06 GMT

I guess my question is what are trying to accomplish under the /tcb directory? It is rare that you should have to directly manipulate those files.

Note that when you are adding files in sudo, these are executable commands, and not just a list of files.

Paul

Re: setup sudo on HP-UX

Victor BERRIDGE — Fri, 03 Feb 2006 11:36:05 GMT

Hi,
In my opinion, creating an account on a trusted box is a more complex process with many things to do... sudo will allow 1 command at a time...

I would for this case use restricted sam (sam -r )to grant a user the privilege of account creation with this more he cannot change root passwd...

All the best
Victor

Re: setup sudo on HP-UX

dgizaw — Fri, 03 Feb 2006 12:27:37 GMT

Well, Those users without having access to /tcb/... they can not create account to the new user. As Victor said, sam -r for a group might be a soltion for my problem. I checked on the man pages and tried it but it is a little bit confusing. After I gave a privileage to a user and when I tried to exit I got a message that the change will be lost if I exited. Am I doing somthing wrong?

Thank you all

Daniel