topic Re: Ability to run script as root in Operating System - HP-UX

Ability to run script as root

Adam Noble — Thu, 06 Oct 2005 05:50:07 GMT

All,

I hope somebody can help. I have a requirement to be able to empower our dba's to run their own backup script as root. The script runs commands as a number of different users within the script and only runs succesfully as root. Is there anything I can set on the permissions to enable the oracle user to run the script effectively as root? Sticky bit rings a bell???

Cheers

Re: Ability to run script as root

Pete Randall — Thu, 06 Oct 2005 06:11:45 GMT

"man chmod"

Pete

Re: Ability to run script as root

Adam Noble — Thu, 06 Oct 2005 06:14:15 GMT

Thanks Pete!

Re: Ability to run script as root

Yogeeraj_1 — Thu, 06 Oct 2005 06:26:58 GMT

hi,

have you considered also "sudo"?

regards
yogeeraj

Re: Ability to run script as root

Adam Noble — Thu, 06 Oct 2005 06:28:01 GMT

I'm still trying to find the answer in the man page of chmod....Ha ha so if anyone can tell me please do!!!

Re: Ability to run script as root

Pete Randall — Thu, 06 Oct 2005 06:35:32 GMT

Adam,

See the sections on setuid: Set user ID on file execution.

Make the file owned by root with informix access to it by group and then chmod 4000 to give it setuid. It will run as root.

Pete

Re: Ability to run script as root

Marco Santerre — Thu, 06 Oct 2005 06:36:02 GMT

From the man page of chmod

permission One or more of the following letters:

r Add or delete the read permission for who.
w Add or delete the write permission for who.
x Add or delete the execute file (search
directory) permission for who.
s Add or delete the set-owner-ID-on-file- execution or set-group-ID-on-file-execution permission for who. Useful only if u or g is expressed or implied in who.

Re: Ability to run script as root

Adam Noble — Thu, 06 Oct 2005 06:38:20 GMT

Ok chaps cheers! I'm afraid I've never really needed to do this previously so is new to me. I like a bit of Sarcasm anyway so cheers all!!!

Re: Ability to run script as root

Muthukumar_5 — Thu, 06 Oct 2005 06:40:12 GMT

By default scripts will not have executiong permission. Check with ls -l . Then change the execution permission with chmod command as,

chmod u+x user permission
chmod g+x group permission
chmod o+x others permission

Or else you can execute as,

sh

hth.

Re: Ability to run script as root

Vibhor Kumar Agarwal — Thu, 06 Oct 2005 06:40:47 GMT

I think "sudo" will be better option.

Re: Ability to run script as root

Muthukumar_5 — Thu, 06 Oct 2005 06:51:07 GMT

I hope i have partially read your question. sudo is suitable. You can use expect script which will do your requirement also.

If you do normally as,

$ su root
Enter Passwd:

with expect scripting it will give input by expecting Enter Passwd: strings.

Another way is piping telnet login to localhost as simply as,

(
sleep 1
echo "root"
sleep 1
echo ""
sleep 1
echo "command to run"
sleep 1
echo "exit"
) | telnet localhost

change username of root and passwd accordingly to user.

hth.

Re: Ability to run script as root

David Child_1 — Thu, 06 Oct 2005 07:53:37 GMT

Hello all,

Unless I'm mistaken, you can't set up a script as SUID. It is such a big security hole that they set it up so SUID is ignored on shell scripts.

I think if you put a C wrapper around your script and set up SUID on that, it might work.

Your best bet is sudo.

David

Re: Ability to run script as root

Bill Hassell — Thu, 06 Oct 2005 08:07:43 GMT

Running a script as root is a common requirement but is an extreme risk to your system's stability and security. The reason is that even if you carefully write the script to prevent getting to a shell prompt, a user can gain unlimited root access. Yes, you can set the SUID bit on the script, change the ownership to root and the script will run as root. You can prevent SUID programs and scripts from running by adding the mount option: nosuid to selected mountpoints. DO NOT use nosuid on /, /usr, /opt since SUID is mandatory for many HP-UX programs. But directories that allow users to create files (/var, /home) should not allow SUID scripts and programs.

Re: Ability to run script as root

Steve McClendon_1 — Fri, 07 Oct 2005 08:39:38 GMT

Would this make sense in your environment?

Restrict the script to root only and place it in the root crontab. Set it to run hourly (or whatever makes sense)to look for a file trigger. If the trigger file exists, then the backup starts. The users can create the trigger file. If the users must supply options, then the option can be placed in (and read from) the trigger file. The file can be removed as part of the backup script.

Using this technique allows you to maintain security.