topic Re: Is it possible to give a user shutdown/reboot perms via sudo? in Operating System - HP-UX

Is it possible to give a user shutdown/reboot perms via sudo?

Stacey Akerstrom — Fri, 14 Nov 2003 14:08:09 GMT

I have a user 'telcom' that should be allowed to shutdown and reboot, using sudo1.6.6.
Although I'm specifying no passwd in the sudo file, I'm still being prompted for a password.
Here's the telcom specific entry:
TELCOM ALL = NOPASSWD: KILL,LPSTAT,CLEAR,FIND,LS,IPCS,IPCRM,CANCEL,PASSWD,LPADMIN

I can only guess that I've added this incorrectly, or I've left out something else.

Thanks-
Stace

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Patrick Wallek — Fri, 14 Nov 2003 14:12:41 GMT

Sudo should work, but it can be done without sudo as well. Add the user to the /etc/shutdown.allow file and that user can then shutdown the system.

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Stacey Akerstrom — Fri, 14 Nov 2003 14:27:55 GMT

Patrick, we really prefer to implement sudo rather than just adding to shutdown.allow, primarily because there are other limited commands we want certain users to be able to run.
However, I'm being prompted for a password, which is what I'm trying to get around.
Any ideas?
Thanks!

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Jeff Schussele — Fri, 14 Nov 2003 14:28:01 GMT

Hi Stacey,

That's thin ice you're walking on.
If a normal user dicovered that they can sudo/shutdown w/o a PW......well I wouldn't want to think about that.
The user should be added to shutdown.allow at most as Patrick points out & then you'd at least have a sudo log to *try* to determine who shutdown the system as long as you don't allow direct logins as telcom.
BUT if you have multiple people allowed to su to telcom, then you might never be able to definitively determine just who ran the shutdown - just candidates. If direct logins are allowed - all you'll have is IPs at best.

I'm a firm believer that VERY destructive utils should be root-only - not even sudo should be allowed & I can't think of a more destructive util than shutdown - except for maybe
rm -rf /

My $0.02,
Jeff

Re: Is it possible to give a user shutdown/reboot perms via sudo?

James A. Donovan — Fri, 14 Nov 2003 14:30:09 GMT

Do any of the command aliases you've listed here actually contain a reference to /usr/sbin/shutdown? Just judging by their names, I wouldn't think so.

Otherwise, as long the user you are logged in as is a member of the TELCOM User_Alias, what you've written here looks correct.

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Stacey Akerstrom — Fri, 14 Nov 2003 14:33:14 GMT

Jeff-
My bad, I didn't explain myself very well.
This user telcom is the *only* user (other than root, of course) that I want to allow to shutdown/reboot. They wouldn't be su'ing, I only did it that way because I was too lazy to go ask someone what the telcom passwd was.
The reason I don't want to add telcom to shutdown.allow, is that I wouldn't be able to trace who did the shutdown/reboot, whereas if they do it via sudo, it will get logged.

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Jeff Schussele — Fri, 14 Nov 2003 14:37:02 GMT

Hi Stacey,

I understand, but even with an su there would still be a log - see /etc/shutdownlog.
This will record the *true* user that ran it.
IF you use su to gain root - and you should - take a look in there & you'll see what I mean.

HTH,
Jeff

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Stacey Akerstrom — Fri, 14 Nov 2003 15:15:19 GMT

The powers-that-be will not go for allowing telcom to su to root, hence the need for sudo.

Re: Is it possible to give a user shutdown/reboot perms via sudo?

Jeff Schussele — Fri, 14 Nov 2003 15:30:46 GMT

No - the user(s) su to telcom - telcom is in shutdown.allow & then they issue the shutdown command.
I think the thought that you want to do this w/o a PW is the very dangerous part of this process. One should always HAVE to issue a PW to get to this "power" level.

Rgds,
Jeff