Giving a user-id the ability to add users (scripted)

[Mike Blatsos]

I have the need to give a user-id other than root the ability to add users via a script. Sudo will not work in this case. The system is trusted if that makes a difference. I would prefer that that user could only add to its group.

[James R. Ferguson]

Hi Mike:

If 'sudo' isn't an option, I'd create a simple C-wrapper, setuid to 'root' expressly for the purpose you describe. The usual caveats apply: make sure that both the wrapper and the script called within are strictly secured.

Regards!

...JRF...

[Peter Godron]

Mike,
have you thought about possible use of access control list (acl) on the useradd etc. binaries ?

For script please see:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=952123

Or how about giving the user restricted SAM (see "man sam" -r option)

Please also read:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33 on how to reward any useful answers given to your questions.

[Mike Blatsos]

More info it it helps, we have a development team from LAWSON here trying to create an automated process to add users. On the windows side it IBM tivoli LDAP which they want to use to add users to HP-UX. They are using a package called ProcessFlow which can read the LDAP DB and through various process comes up with a 8 character UNIX id and from a table of preassigned UID's they grab an available UID. Too late in the process to use LDAP-UX... The killer is that all the created user-id's are deactivated (internal use only).