ID to run specific command

[so.nimda]

Hi,

I have a junior administrator whom I would like him to do some specific OS task.

I do not want to grant him root access and assigning UID 0 is a definite no.

I have read in posts here that "sudo" can be used, but wouldn't that also allow commands like "rm *.*" to be executed also?

Is there a way for me to only limit his access to certain specific commands like, for example, "lpstat"?

Thanks in advance.

[Jeeshan]

Hi

Do you heard about ACL?

May be this way can help you.

[so.nimda]

Hi ahsan,

Could you care to elaborate on ACL?

How do I implement it?

Thanks

[Jeeshan]

Hi again

read this

http://docs.hp.com/en/5992-2146/ch09s05.html

[Kapil Jha]

If you or your management have hired him , i suppose you have to believe in him.
Nobody is crazy to fire rm * on a system if he has worked on UNIX.
Just ask him to take care while working then he would be more productive.
If you want him to run only a coulple of command try ACL as said by Ahsan or you have use restricted shell and copy some of basic command (if they are very few) in his shell.
BR,
Kapil

[so.nimda]

Thanks for the link.

I have read it and it seems that it's for SD (software distribution).

How do I go about implementing it for OS command like "lpstat", or "ls"?

Thanks

[so.nimda]

Hi Kapil,

Thanks for your reply.

It's just a precaution that I would like to take as he fresh with zero unix knowledge.

"Nobody is crazy to fire rm * on a system if he has worked on UNIX"? Fact is - he has never worked in a unix environment.

Anyway, as I only need him to perform specific tasks, removing other access would seem more practical than asking him to be careful, as even experience administrators do sometimes make mistakes, too. ;)

[Kapil Jha · Accepted solution]

thats OK if he does not have any UNIX exp.
well from the beginning u seens to be intersted in lpstat command.
You can copy this command in this home directory....and it will work for him....
BR,
Kapil

[Jeeshan]

Hi

may be this can help you briefly

http://docs.hp.com/en/B2355-90950/ch08s04.html

You may consider another thing. Give him a account with restricted shell and copy the commands he need to do his job.

[so.nimda]

Thanks, ahsan & Kapil

Will explore the shell alternative for him.

Regards

[Dennis Handly]

>Is there a way for me to only limit his access to certain specific commands like, for example, lpstat?

Yes, you can limit commands to sudo.
There is also HP's RBAC. See these links:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1215907
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1206541
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1204720

[Yogeeraj_1]

hi,

you may also wish to write a simple menu driven application that allows him to run the restrictive commands.

In this case, he won't even need to know the command that would be run in the background.

Indeed, SUDO will be the tool of choice in any cases.

kind regards
yogeeraj

[Ron Irving]

Once he has a little experience, turn him on to this forum. There is a wealth of knowledge here.