Limited root permissions to a non-root account on trusted system

[Glenn Mitchell_2]

How do I allow a non-root user to perform selected root tasks without giving them the ability to su to root - and giving them the root password? The system is HP9000/800 N4000 HPUX 11.11 setup as a Trusted System.

[Cheryl Griffin]

sudo
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.7p5/

or set up Restricted SAM

[Sundar_7]

You can use restricted sam.

execute sam -r as root, select the user and enable the selected privileges for the user.

Alternative way would be to install SUDO package. Sudo is available for free from the net.

[Mel Burslan]

as the two previous posters said, sudo is the best fit to your needs but as a commercial alternative (better in logging events in a more secure way) is powerbroker. According to my last conversation with them, their licensing starts with a 10 servers for $2000/server + 20% yearly maintenance/upgrades. Very reliable product as I have used it in the past.

But if this is for a casual use, sudo is the better option for the unbeatable price of zero :)

[Glenn Mitchell_2]

Thank you for your replies. I will have to research the sudo utility.

The non-root user needs root permissions to give a database application utility permissions to kill select DB processes and gracefully remove the records from the database. Using the DB's utility (as non-root user) will show the pid but the utility refuses to delete it without root permission.

I can not use the restricted sam Process Contol to kill the selected process (outside the database) because the rest of the DB's cleanup functions will not happen and the database might become corrupt.

Would sudo help me address this problem?

Thank you for your help.

[Sundar_7]

Yes, with the above requirements, I think sudo is the way to go.

Create a script as root that does that everything u would like the user to be able to do. You can also limit the users ability in this case by filtering the PIDs inside the script.

For accountablity reasons, you can also log the opetaions performed in the script by the users in a file.

Install sudo and allow the user(s) permission to execute this script as root.

[Robert Fritz]

One thing I'd add to the last post: if you're going to write a script to do a privileged function on behalf of a non-privileged user, I'd only use that as an administrative barrier unless you thoroughly analyze that code for unintended side-effects that a user could exploit to gain root. Shell script has inherent issues like escape characters, and ENV variables that change commands' behavor. These are in addition to the side-effect potential of any elevated privilege program. Short version: I'd be careful.

[Brian Markus]

I use both sudo and restricted sam. Sudo is really easy.
Here is a link to the depot file.
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.7p5/

Gunzip the file then use swinstall -s /tmp/filename.depot to install it.

Here is a sample config:

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
# Host alias specification

# User alias specification
#Operators
User_Alias OPERATOR =user1, user2

# Cmnd alias specification

#Commands Operators are allowed to run as root
Cmnd_Alias KILL = /usr/bin/kill
Cmnd_Alias RM = /usr/bin/rm
Cmnd_Alias PGP = /opt/pgp/pgp

# Defaults specification
Defaults syslog=auth

# User privilege specification
root ALL=(ALL) ALL

OPERATOR ALL =KILL,PGP

# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL

# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now





Hope this helps.

-Brian.

[Glenn Mitchell_2]

Thank you for your replies.

I have downloaded the latest sudo software with associated docs and will be installing it on our development server Monday for evaluation prior to use on our validated production server (nothing is ever easy here). Thank you also for the sample config file â that will help a lo

[Rick Garland]

Here is an entry I believe is important in the sudoers file as well.

%grpname !/usr/bin/su *root*,!/usr/bin/su "", !/usr/bin/su -l,!/usr/bin/su -

I include this entry because I used to have users getting root access to systems and they did not have root passwd - I didn't know how they were doing it. I discovered that they had root access on 1 system. From this 1 system they would do an rlogin to a trusted system. The rlogin would take them to the other system as root! (Not Good)

This entry will prevent the users in the %grpname from becoming root but you can have cmd_aliases that specify the command they are suppose to work with.

[Brian Markus]

Sudo should work very well for you. I see that you haven't assigned any points to your posts. Assigning points is enough for most of us. :)

Good luck.

-B