Create new user with root privileges

[maxell_1]

Hi Guys,

I do not wish to use the default root user due to security reasons and thus trying to create a new user with root privileges to do my admin tasks.

What is the appropriate useradd command options to use in order to do this. The username I wish to use is "admin".

Thanks

[candlejack]

Hi,

There's really no such thing as "root privileges," but you can obtain what you are looking for mostly by assigning many secondary groups to your "admin" user.

[Court Campbell]

Implement sudo.

[Tim Nelson]

>>I do not wish to use the default root user due to security reasons and thus trying to create a new user with root privileges to do my admin tasks

If you create another user with root privelages it negates any security concerns because that user can then do anything that root can do...

If you wish to only give "some" privelages to another user then either sudo or restricted SAM is the way to go.

Again, if you wish to create another username with complete "root" privs then you might as well just give them the root password.

[maxell_1]

Not really totally becoming root actually.

Rather my intention is to allow this new user to be able to perform tasks and execute commands pertaining to Network configuration and troubleshooting, DNS configuration, Backup as well as NFS.

Do i really need to assign this new user a user ID of 0?

[James R. Ferguson · Accepted solution]

Hi:

The 'root' user is *any* user with a uid=0.

Do *not* have multiple user accounts with uid=0. Not only is this a great security risk, but it is dangerous for the following reason:

# find / -user someuser -exec rm -rf {} \+

...you *thought* you were cleaning up "someuser" but when its uid=0, you just removed 'root's files and directories!

Using 'sudo' is the most appropriate, safe way to do what you want.

Regards!

...JRF...

[Court Campbell]

No, install sudo.

[maxell_1]

Alright, I will try to use sudo. Thanks everybody for your valuable advice :)

[Steven E. Protter]

Shalom,

sudo is available from http://software.hp.com as part of Internet Express.

Search for it and you can choose to download sudo alone.

This will include all dependencies which the version from the Porting and Archive Center make you do for yourself.

sudo is the way to go.

SEP

[Safarali]

Hi Samuel sudo is the best practise you can monitor the activities if you are only want cetrain task then better to go restricted sam builder so user can only do the certain task


Regards
Safar

[Asif Sharif]

Good day smauel,

HP-UX RBAC is an alternative to the traditional "all-or-nothing" root user model, which grants permissions to the root user for all operations, and denies permissions to non-root users for certain operations. HP-UX RBAC allows you to distribute administrative responsibilities by creating roles with appropriate authorizations and assigning them to non-root users and groups.

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=A
ccessControl

http://docs.hp.com/en/5992-2395/ch05s05.html

Regards,
Asif Sharif

[Court Campbell]

I was going to mention rbac as HP doesn't support sudo, but rbac is a pain to setup and make changes to IMO. Sudo is a lot easier to implement.