root user privileges for select functions only--without restricted sam.

[Dee_3]

We have several rp2400 11.0 systems that we would like to create a user with root privilege for only 3 sysadmin functions: ie. (1) stopping and starting the lp scheduler (2) removing and re-adding printers and (3) changing passwords on userids. We would rather not use restricted sam for this if possible. Any suggestions? Thanks, Terri Christensen.

[A. Clay Stephenson]

You have basically two options:

1) Download and install 'sudo' from any of the HP-UX Porting Centre's

2) Create small C setuid wrappers.

[MANOJ SRIVASTAVA]

Hi Teri


How about trying a super user with rsh , like create a user and change the default shell to rksh and the uid to 0 and gid to 3 . In the .profile for that user you can specify a path of a direcort which just holds these command like lp. passwds etc .
"
The restricted shell is designed to put the user into an environment where his or her ability to move around and write files is severely limited. It's usually used for "guest" accounts. You can make a user's login shell restricted by putting rksh or ksh -r in the user's /etc/passwd entry.

The specific constraints imposed by the restricted shell disallow the user from doing the following:

Changing working directories: cd is inoperative. If you try to use it, you will get the error message "ksh: cd: restricted".

Redirecting output to a file: the redirectors >, >|, <>, and >> are not allowed.

Assigning a new value to the environment variables SHELL, ENV, or PATH.

Specifying any pathnames with slashes (/) in them. The shell will treat files outside of the current directory as "not found."

These restrictions go into effect after the user's .profile and environment files are run.

This means that the restricted shell user's entire environment is set up in .profile. Since the user can't overwrite that file, this lets the system administrator configure the environment as he or she sees fit.

Two common ways of setting up such environments are to set up a directory of "safe" commands and have that directory be the only one in PATH, and to set up a command menu from which the user can't escape without exiting the shell.


Manoj Srivastava

[Martin Johnson]

If you go with Clay's small C setuid wrappers, be careful and test thoroughly, especially ownership of files and processes created. I created a setuid wrapper for our operators to recycle the OVO Agent. Unfortunately, all the OVO Agent processes started as user operator rather than user root.


Marty

[Sridhar Bhaskarla]

Hi Terri,

"SUDO" is the best solution. You can also audit the commands run by the user. You can get it from

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/

Other "insecured" way is to create a group and place only this user in it.

Then write a script with some case statements in it that will do the job. Now give sticky bit to the script with "only" execute permissions for the group and "no" permission to others.

-Sri

[Dee_3]

Thanks everyone. We've downloaded sudo and will be looking at that. We were looking for other options if available. Thanks again, Terri Christensen.

[Darrell Allen]

Hi Terri,

You might also look into HP's ServiceControl Manager (SCM) at http://www.software.hp.com/products/SCMGR

I've just started looking into it so I don't have much info. It, like sudo, is a free tool that may do what you want (and more).

You can search the forums and find a number of hits on SCM.

Darrell