Users requesting access to ID www or group other for Tomcat

[Jason Fedynak]

I have a couple of users requesting access to either user 'www' or added to the group 'other' so they can configure the Tomcat application for use with various software packages (ie TOPIC). What, if any are the best practices for allowing them to configure files within Tomcat without opening the system up. Would allowing them access to user ID www only through 'su - www' be ok. If so, how would you configure the ID so you could only su to the ID www?

Thanks...

[Sundar_7]

What is the version of HP-UX ? If 11i or 11.0 with JFS version 3.5, you can add ACL entries such that the users who are requesting access can be granted permissions to the files owned by "www". This way the users dont even have to know the password.

A user can su to other accounts only if the user knows the password for the account.

If I understand your question correctly, as long as the user has the password for only user "www", the user cannot su to any other account.

[Geoff Wild]

If www isn't used anywhere else, then sure - give them su capability...but, what about the group other? If used elsewhere, you may want to re-install Apache/Tomcat do be in it's own unique group.

Never allow a generic/appication id to login directly.

Rgds...Geoff

[Steven E. Protter]

Problem with giving the users www user access is that if www owns the webserver, they could change permissions on that openning up security and operaional vulnerabilities.

If faced with this request I would find out what the customization they want to do is, exactly what it was and see if systems adminitration could do it.

I don't think the profile on user www is set up to allow for interactive use. Check the shell in /etc/passwd .

I'd think you need to create a special user for this with the normal shell and make it part of group other.

I would not want to do this as su - www.

SEP

[Jeff Schussele · Accepted solution]

Hi Jason,

This is a classic example of the need for and best use of sudo.
Find out the exact commands they need to run - full path - full syntax & configure sudo to run those commands *only*. You can give them either www user or other group permissions. But *all* they'll be able to run is those commands listed in the sudoers file.

If you don't have it you can get it here:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.7p5/

And if even that makes you nervous - you can just remove the ability when they're done be removing the config from the sudoers file.

HTH,
Jeff

[Sundar_7]

Ability to successfully use SUDO here to restrict access also depends on how the users are going to modify (or configure) files.

If the users are going to be editing files using some kind of a editor (say vi), it would be impractical to list all the files they are going to edit in the allowed list of SUDO commands.