setup sudo on HP-UX

[dgizaw]

I am trying to setup a sudo for users to have privilage of creating account . I did the following :
#User alias specification
User_Alias PRESIDE = admin
#Cmd Alias spec
Cmd_alias ADDUSER = /lhome/root/au, /usr/bin/passwd,/usr/bin/chown, /usr/sbin/useradd, /tcb/files/auth/*

#user privilages spec
PRESIDE ALL = NOPASSWD: ADDUSER



when I try to excute /opt/sudo/bin/sudo /lhome/root/au

I am getting : Password cannot be changed, Reason: cannont access protected password entry.

Can you help?

Thank you

[Paul F. Carlson]

Your command alias is incorrect.

Cmd_Alias ADDUSER=/usr/sbin/useradd

Then when you run sudo as user "admin":

/opt/sudo/bin/sudo /usr/sbin/useradd [options]

[Indrajit_1]

Hi;

Try this

#visudo

User_Alias PRESIDE = admin

Cmd_Alias USERADD=/usr/sbin/useradd

Cmd_Alias PASSWD=/usr/bin/passwd

#sudo /usr/sbin/useradd
#sudo /usr/bin/passwd

Cheers
Indrajit

[dgizaw]

Thank you for your immediate response. I was out some palce. Sorry for that. su to admin helped. and also modified as both of you told me. the only problem now is accessing /tcb/files/auth/[a-z]/*

How do I put it?

PRESIDE ALL = NOPASSWD: /tcb/files/auth/[a-z]/*

Thanks
Daniel

[Paul F. Carlson]

I guess my question is what are trying to accomplish under the /tcb directory? It is rare that you should have to directly manipulate those files.

Note that when you are adding files in sudo, these are executable commands, and not just a list of files.

Paul

[Victor BERRIDGE · Accepted solution]

Hi,
In my opinion, creating an account on a trusted box is a more complex process with many things to do... sudo will allow 1 command at a time...

I would for this case use restricted sam (sam -r )to grant a user the privilege of account creation with this more he cannot change root passwd...


All the best
Victor

[dgizaw]

Well, Those users without having access to /tcb/... they can not create account to the new user. As Victor said, sam -r for a group might be a soltion for my problem. I checked on the man pages and tried it but it is a little bit confusing. After I gave a privileage to a user and when I tried to exit I got a message that the change will be lost if I exited. Am I doing somthing wrong?

Thank you all

Daniel