DBA's allowed to run sudo commands

[Laurie A. Krumrey]

Why is it every time I hit the enter key this thing posts? Is it me or the List server? Anyway, my dba's want to be able to see all the kernel settings "kmtune -S /stand/system" and I was thinking of giving them sudo for this. Does anyone see any security problems with this?

Laurie

[Craig Rants · Accepted solution]

Laurie,

I don't see a security problem per say, but if you give them kmtune you are exposing your kernel. I would say it depends on the dba but my response to a dba would be no. Sometimes it is better to just provide them information instead of letting them do the work.

Just my opinion,
C

[Sanjay_6]

Hi Laurie,

kmtune can be used to configure / set the kernel parameter. "kmtune -s", note s is in small character. I won't advise your DBA to be allowed using kmtune. If they want a list of kernel parameter, take a printout of kernel parameter using "kmtune -S /stand/system" and give them a printout. This is what we do at our site.

Hope this helps.

Regds

[harry d brown jr]

Are you saying you can't trust your DBA's?

All kidding aside, just set up a script to do it. then chown root script.sh, then chmod 4555 srcipt.sh.


live free or die
harry

[Darrell Allen]

Hi Laurie,

Since kmtune can also be used to set kernel parameters, don't give unrestricted access to it. Use sudo on a script that does exactly what you want to allow and you should be fine.

Darrell

[James R. Ferguson]

Hi Laurie:

Let me ask this: How often is this information going to change? Why not generate the data for them and just hand it (or web-post it) for their use?

Regards!

...JRF...

[Tim Nelson]

Did I miss something here ? Any normal user can execute /usr/sbin/kmtune. If you attempt to set a parameter as a normal user you get an error.
Sometimes it is not neccessary to make life harder than it is :-)>

[Sanjay_6]

Hi Laurie,

I saw Tim's post and just checked my system. The kmtune command is listed in /usr/sbin. My users don't have this path specified by default in their profile. However then can use /usr/sbin/kmtune -S /stand/system to get the list of kernel parameters.

If they try to change the parameter using /usr/sbin/kmtune -s par_name(+/-)some_value -S /stand/system they get an error message saying "kmtune: Directory permission denied to write file -- /stand".

So i guess, your DBA's can use kmtune to get the kernel parameters.

Thanks Tim for pointing out the errors we all made in not checking the same yesterday.

Regd

[Craig Rants]

Tim,
If you give the dba kmtune through sudo, you have given them the ability to make the changes discussed. The issue was really sudo and not kmtune per say...

At least that was my take.
C

[Darrell Allen]

Hi all,

When I try is as a normal user I get:
kmtune: Cannot write file -- /stand/.kmsystune_lock

/stand has 555 perms on my systems and should stay that way so that normal users can't write to it.

Darrell

[Aaron Johnson_3]

FYI - It appears that 11.11 will allow a regular user to run kmtune, but 11.00 will give the error message:

kmtune: Cannot write file -- /stand/.kmsystune_lock