mount for non-root users

[sahertianr]

Hi,

How can I manage that non-root users can mount?
As a test I chmod the file: mount with 777.

I still get the message: must be root to use mount.

Thanks,
Ron

[Vijaya Kumar_3]

One way:

You can setup SUID for this mount command But this is insecure and not recommended.

Second way:
Try using using "sudo" package and give permissions for specific users to mount

Thanks
Vijay

[RAC_1]

Unless user have a read/execute perms on dir where mount is, even doing chmod 777 is not going to help. You can set suid, but there is security risk involved.

Get sudo, then you can grant a user right to run particular command.

[Pete Randall]

Ron,

I'm not sure that setuid would even work. Really the only acceptable way is to use sudo

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.7p5/


Pete

[sahertianr]

Thanks all,

And just for my understanding:
What is the security hole with SUID??

Cheers........

[Jeroen Peereboom]

Well,

I am not happy if every user can mount a filesystem as he/she wishes. If you make mount SUID, you cannot limit the mount requests to a specific device. Using sudo you can write script to (u)mount a specific device on a specific mount-point. That's acceptable.

By the way: is 'mount' the same file as 'umount' (a hard link)?

JP.

[sahertianr]

No Jeroen, not a hard link...

[Jeroen Peereboom]

Ron,

in Linux one can put options in /etc/fstab.
Reading the replies it seems HP-UX doesn't support these options (like owner, user). Check the man pages.

Greetings from grey-ish Holland,

JP.

[Rory R Hammond]

Our servers are in a Locked room.
Several thing that have worked for me.

1. Have the user FTP files to a temporary directory and install for the the temp. directory.

2. Put a samba share out for a temp directory. Have the user drag and drop the files from their PC to the temp directory.

Advantage is:
1. We have a large tmp directory called /usr/tmpi.(same perms a /tmp) We manage via cron by deleteing files that are more than 2 months old.
2. The user worries about permissions and access. I don't have to edit sudo adding and subtracting application users.