SUDO ROOT ACCESS

[oprakash]

Hi,

I have installed sudo 1.7.1 in hp ux 11.00 operating system. In which i have addedfew ID's for testing purpose.

But if user enter $ sudo /usr/bin/sh (or) $ sudo su root. they can access # prompt. I want to restrict this root access. I have gone through few installation notes, but i am not understand this.

Kindly find the below /etc/sudoers file for your reference, request you to suggest me for the same.
# pg /etc/sudoers
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
# Failure to use 'visudo' may result in syntax or file permission errors
# that prevent sudo from running.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification
User_Alias SERVERADMIN = oprakash,iychandr
User_Alias PROGRESSDBA = prohmann,kgarvey

# Cmnd alias specification
Cmnd_Alias CHMOD = /usr/bin/chmod
Cmnd_Alias CHOWN = /usr/bin/chown
Cmnd_Alias SAM = /usr/sbin/sam
# Defaults specification

# Runas alias specification
# User privilege specification
root ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL

# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now
SERVERADMIN ALL=NOPASSWD:ALL
PROGRESSDBA ALL=NOPASSWD:ALL
# SERVERADMIN
# Default
Defaults logfile=/var/adm/sudolog.log

[VK2COT]

Hello,

You need to change the following lines to
narrow down the listing of commands that SUDO
users can run:

SERVERADMIN ALL=NOPASSWD:ALL
PROGRESSDBA ALL=NOPASSWD:ALL

At the moment, you allow oprakash, iychandr,
prohmann, and kgarvey to execute ANY SUDO
command!

What exactly you want these accounts to be
able to run as privileged user?

We need more details on what you are trying
to achieve.

You have really good examples at:

http://www.sudo.ws/sudo/man/sudoers.html

Cheers,

VK2COT

[Sunny123_1]

Hi

You should change the last lines in your sodoers file.If you want to give them chmod access then make an entry like following

SERVERADMIN ALL= CHMOD
PROGRESSDBA ALL= CHMOD

SERVERADMIN ALL=(ALL) NOPASSWD: CHMOD
PROGRESSDBA ALL=(ALL) NOPASSWD: CHMOD


Regards
Sunny