User creation

[Karthik S S]

Hi,

I would like to create a user who should be able to control all others user's home directories should be able to create/delete/modify contents of the other user's files/directories. How can I accomplish this??. But, that user should not have any special privileges on other directories than /home.

Pl. help.

Thanks
Karthik

[Sridhar Bhaskarla · Accepted solution]

Hi Karthik,

SUDO is ideal for you. It is easy to setup and install. You can get sudo from HP's porting site.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/

More information including FAQ is available at

http://www.courtesan.com

You will have to manipulate sudoers configuration file to achieve what you need.

-Sri

[RAC_1]

You can use sudo(Superuser do) utility.

With this you can give waht commands a user can run.

[Rajeev Shukla]

Create any user and give him restricted SAM access. Give him only user administration and dont give anything else.

then he can delete, add and modify users

[T G Manikandan]

Another thing I would suggested is
having a restricted SAM account.
Do a sam -r from root

#sam -r

Give the requied file access permissions to the user you are planning to.

Thanks

[Ravi_8]

Hi karthik,

sudo is the best suit for this operation as said by Sri

[Michael Tully]

You will need to set up sudo, as suggested. You could make changes to the directory permissions and create a group that controls it with permissions of 775.

you can't really use a restricted 'sam' as it is captive. You won't be able to modify directory/file conetents from there.

[T G Manikandan]

Also there would be other way like using ACL's
If you have JFS3.3 version then you can use them.

MOst prefer sudo,then that should be the right choice.


Thanks

[Systeemingenieurs Infoc]

I'm not sure about sudo. How can u accomplish access to all homedir-files and no other files ?

[Karthik S S]

Yeah .. I agree with you. Could any one suggest me how do I set the user and command alias to accomplish the required task? (i.e. the user should have full access only on /home)..

Thanks
Karthik

[Pete Randall]

I agree, Karthik. Sudo, in this case is "nodo". It won't accomplish what you want. Michael's suggestion about creating a controlling group that would have access to /home/* would seem to be the most likely solution.

Pete

[Karthik S S]

Hi,

But even if I create a group with 775 permissions for /home/* if a user creates a file with 077 permission then that group owner cant do anything about it right??. I am more confused now :-(

Pl. help

Thanks
Karthik

[Pete Randall]

Sorry, Karthik, I mis-read Michael's post. He's suggesting a combination of sudo and group permissions and I'm not sure quite how that would work.

I'm as confused as you now.

Pete

[Karthik S S]

Hi

I found some workaround for this task. i.e giving a particular user the "su" access to login as other user save root.

Host_Alias SERVERS=host1

suhome SERVERS=/bin/su ?*,!/bin/su root,!/bin/su - root

The user suhome will be able to login as any other user in the system but not as root. But this still may have some security risk. Could anyone suggest me if there are some other ways to do it??

Thanks
Karthik

[Systeemingenieurs Infoc]

I see 2 solutions :

1. write scripts for every functionality u want to give tot the admin : create dir, rempove dir, ... (no vi plz). Then let him execute the scripts via sudo.

2. use samba : create a service for /home and allow you admin to map it on his windoz. He'll be able to mess around with the files at will. 1 thing : do a "force user=root" (i hope that's a good idea, but at first sight it is).