sudo - how to allow lp cmds for a non-root user

[Basheer_2]

Good morning
Just installed sudo 1.6.8p12 (11.0, 11.11 and 11.23)
Need to give access to non-root user ( operator) to
1) list print jobs
2) cancel jobs
3) mount nfs
4) umount nfs
5) add users

how to do this.

Thanks and Appreciate your help

[Antonio Cardoso_1]

Hi basheer,

you just need to edit /etc/sudoers to grant permissions to various commands.
=> man sudoers will give you detailed information on rich features of this file.

A simple example :
User_Alias MYUSERS = joe, john
MYUSERS jupiter = NOPASSWD: EXEC: /usr/sbin/ioscan

will allo users joe, john to use ioscan command by running:
sudo /usr/sbin/ioscan

H.T.H.
antonio.

[Ramaprasad N]

Yeah, sudoes man page will provide all the details. You need to use visudo command, to edit the configuration file.
First you need to create a Command_Alias, for all the commands which you want to be executed from the specific list of users.
Ex: Cnmd_Alias SU = /usr/bin/su
Then you need to create a User_Alias, which will have all the users list.
ExL User_Alias TEST=joe, john, robert
Finally, grant privilege statement, to allow users to execute those commands.
Ex: = PASSWD/NOPASSWD:
In this example, TEST = PASSWD:SU

Hope it works,

Ram

[Robert Bennett_3]

we use sudo for our operators for many things, but we use restricted sam (sam -r) as well. We give operators restricted sam priveledges in the printers section and the user section.

Just another thought.

[Rick Garland]

Here is an example. For additional commands just add to the end of this list.

%helpdesk ALL=NOPASSWD:ALL, /usr/sbin/accept,/usr/sbin/reject,/usr/sbin/lp
sched,/usr/bin/cancel,/usr/bin/cancel -e,/usr/bin/cancel

[Basheer_2]

Thanks All,

Robert,
pl can you tell me the steps to give sam -r for the user operator.

[Robert Bennett_3 · Accepted solution]

sure -

you have to be root

sam -r
cancel the "Load Priviliges" window
right click in the Restricted SAM Builder window - Disable All
Right click on the Accounts for Users and Groups Icon - Enable All ( note - you may want to restrict your operators further and can go within this Icon for more refinement)
Right Click on Printers and Plotters Icon - enable all ( same note is applicable)
Actions -> Templates -> Save - name it what you like (operators)
now close sam and go back into Restricted SAM - sam -r
highlight the user you want to have the restrcted sam priveleges - highlight template to be loaded (operator)
OK
Actions
Save Priveleges

Now here's a little shortcut - you will note that this has generated a file in /etc/sam/custom/.cf
you can easily copy this fiule for other users (they naturally need to already be users on the system) as in
cp /etc/sam/custom/username.cf /etc/sam/custom/newusername.cf
You can also use this to scp to other servers. saves a lot of time.

HTH