Help with granting root privledges -

[Angie_1]

I need to be able to give people root access privledges without giving them the root password, but need to be able to track them too.

We have 'suroot' which is on our 10.20 systems but I need something for 11.11.
Does anyone know anything about Sudo? I did download it from the portal but only saw 11.0 version, I downloaded it anyways but had a few errors on the install.
Does this sound like what I need or is there something better?

Again I want to be able to track what the user does when they sudo or suroot. I also want them to use their own password so they don't know the root password.

Thx..Angie

[Patrick Wallek]

Sudo is the way to go!

Here is the main web site for sudo:
http://www.courtesan.com/sudo/

Your best bet for 11.11 will probably be to download the source and compile it yourself. I haven't seen any precompiled depots for 11.11 yet.

[Tom Maloy]

sudo is a good package. You can specify sets of users and sets of commands that they can execute. You can also exclude commands (shutdown, reboot, insf, ...) that users can execute. And I believe that you can configure syslog to log sudo messages to a separate file as well.

[steven Burgess_2]

Hi Angie

Have a look at the main web page. There is all sorts in there

Installation
troubleshooting
manual pages

http://www.courtesan.com/sudo/

HTH

Steve

[Michael Elleby III_1]

Angie-

As there are many ways to implement this, The easiest way that I did this was to create a second user with root's UID of 0. This then gave them access to root privliges that they needed. Thus, the user is logging in as themselves, and not root. As far as tracking what they do, First place to reference, the .sh_history file in their home dir.

Just my $.02 worth

Mike-

[Angie_1]

Wow that was quick! Lots of replies.

Well I feel stupid asking this question but I don't know how to compile. How hard is that to do for 11.11?

Thx!
Angie

[Patrick Wallek · Accepted solution]

If you download, gunzip, un-tar the source, there is a file there called INSTALL that tells you what to do step-by-step.

It is pretty easy.

[Patrick Wallek]

On another note, I wouldn't recomment creating another UID 0 user. That user WILL BE root with all privileges. It would be difficult to track. Yes you have the .sh_history, but only if they use the shell history function, and only if they don't empty the file.

[Angie_1]

Ok thank you all for your quick help. I will download the source... and go through the steps for installation.

Thx again!
Angie

[Nick Wickens]

The problem I found with tracking using SUDO was that it's possible to run a new shell from sudo which means you are then running completly free and untracked (SUDO will just report that the user ran ksh or sh etc)as root. (I think that there are ways to limit what sudo users can run but I did'nt achieve this as far as shells are concerned so if anyone has any clues then feel free to offer them.)

In my case though I had a set list of tasks that I wanted ops to run so I placed them in a "trapped" menu and set each task up as scripts with the sudo command being the menu option calling that script and then cancelling the sudo ability (-k option I think) as soon as the task was finished.

SUDO can be set to always request the user to re-enter their password before starting the command - that way if they forget to lock their terminal or logout no-one else can run their sudo options.

[John Payne_2]

Angie,

Look at this thread:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x0ca672234586d5118ff00090279cd0f9,00.html
There are some good pointers (from me and others, on how to set up sudo.)

The disable-root-sudo option during configuration will prevent the problem Nick was talking about with gaining root access.

When you download the sudo source, the "INSTALL" file in the tarball as all the configuration time options you may need. If you find an option you have forgotten, chances are that they are in the man page for 'sudoers' under flags. The format in visudo will be:
Defaults mail_always
for example.

sudo works great. you just enable the users for what they really need and let them go. Then you never have to worry about the root password, and you can watch what they are doing.

Hope it helps

John

[Bill Hassell]

Save yourself a lot of time. The sudo package from the Liverpool archive installs and runs just fine on 11.11 as well as 11.0.

NOTE: there is a packaging error with the current version (actually, it may be a bug in swinstall). When you setup a depot and load sudo, you'll get an error about invalid user/group ID and it exits saying that the package is corrupt. The problem (I think it is a bug in swinstall) is due to the INFO file in the sudo-RUN directory. At the top of the INFO file, there is the settings for sudo (mode, owner). The owner and group are both 0, but customarily, these have always been symbolic names like root or sys.

Apparently, swinstall doesn't like a number so by manually editing the INFO file at the location where the sudo program is assigned ownership, the error goes away. It has been reported to HP.

sudo has the ability to limit the actual commands that are allowed or explicitly exclude certain commands. Even the parameters for commands may be restricted.

Once sudo is in place, remove *ALL* alternate root users (other IDs with UID 0)

Here are a few other ideas on controlling root access:

To truly control users from making dumb mistakes, create a new group just for su, perhaps called suroot. Then add only your trained sysadmins to that group, and finally, do this:

echo "SU_ROOT_GROUP=suroot" >> /etc/default/security
Now, even if casual users know the root password, they cannot use su to gain root access. Protect root privileges even further with:

echo "console" > /etc/securetty

Now, root cannot login anywhere except the system console.

[John Payne_2]

Come on Bill, doing it the hard way is good for the soul! Plus you learn all available options.

But seriously, the suroot idea is a very good one.

John

[Angie_1]

Hey Bill - would I be able to talk to you about this a bit further? Let me know...thx... Angie