root permissions to a user

[Lana Cameli]

Hi there;
I would like to create a user login to be used by oncall person and give them permission to reboot, reset password for self or users (but not root), access scripts in root directories and have rights to execute them and such...all remotely. Is there a way to do it?

[Coolmar]

Hi Lana,

There is something called RBAC (Roll Based Access Control) and you can read up on it here: http://docs.hp.com/en/5991-0709/index.html

The problem is that it is only available for 11.23. What version of HP-UX are you running?

[Lana Cameli]

Hi Coolmar;
We are running version 10.2

Is there a way to at least allow this user to reboot without su?

[siva0123]

Hi
you can create the user id with -o option
to duplicate the user id 0 for that user.

useradd -u 0 -o .......

But beware this makes the user do anything as a superuser or root does.

Thanks,
siva

[Coolmar · Accepted solution]

Hi Lana,

Have you tried "sudo"....that is really the only work around if you don't have 11.23 and RBAC. I have used it many times in the past and it works very well and is pretty easy to setup.

[Christian Tremblay]

Yes, Install sudo on your box, then in the sudo configuration file you can, for every user, specify what commands that user can run as root.

DO NOT create any user with UID 0, this is bad practice and will set off security audits flags if your site is security conscious.

Chris

[Lana Cameli]

Thanks guys;
I have sudo installed and added user names to the /etc/sudoers

:)

[Dennis Handly]

>Is there a way to at least allow this user to reboot without su?

See shutdown(1M) for /etc/shutdown.allow.