Alternatives for sudo?? Post: 302442088

Sponsored Content

Operating Systems Linux Red Hat Alternatives for sudo?? Post 302442088 by pludi on Tuesday 3rd of August 2010 09:00:28 AM

08-03-2010

Registered User

Define "it's not working". What error message are you getting (if any)?

Example sudoers entry:

Code:

pludi ALL = (root) NOPASSWD: /usr/bin/id

Usage:

Code:

$ sudo -l
User pludi may run the following commands on this host:
    (ALL) ALL
    (root) ALL
    (root) NOPASSWD: /usr/bin/id
$ id
uid=1002(pludi) gid=100(users) groups=10(wheel),16(dialout),33(video),100(users)
$ sudo id
uid=0(root) gid=0(root) groups=0(root)
$ sudo /bin/echo Test
pludi's password:
Test

---------- Post updated at 15:00 ---------- Previous update was at 14:57 ----------

Quote:

Originally Posted by hergp

@Pludi: growisofs does not run under sudo by design for security reasons, because it can be abused to execute arbitrary programs with elevated privileges, as stated in the man page.

True, didn't see that, thanks for pointing it out. But in the same section it presents a wrapper script that can be used in place of the real executable, as well as the recommendation to change it to SUID, as it will drop the privileges itself. That way, neither sudo nor ssh are needed.

Quote:

But note that the recommended alternative to the above "workaround" is actually to install growisofs set-root-uid, in which case it will drop privileges prior accessing data or executing mkisofs in order to preclude unauthorized access to the data.

pludi

View Public Profile for pludi

Find all posts by pludi

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

ASP alternatives

I have just found out that a project I have developed in ASP (ultradev) needs to be migrated to a unix server and won't be able to support asp. Can anyone point me in the right direction to see what my options are with Unix? I have never worked with or developed for a Unix box before. Also,...

2. UNIX for Advanced & Expert Users

Alternatives for CLOCK_MONOTONIC

Hi, I need to develop timeout functionality in my code, which is not affected by system's time changes.Unfortunately I dont have CLOCK_MONOTONIC support in my OS. Are there any alternatives?

3. Linux

ntop/Nmon alternatives

Hi folks, Any folk has experience on ntop/Nmon ntop - network top and its spinoff NMON Welcome to nmon.net Nmon Nmon - Wikipedia, the free encyclopedia nmon for AIX and Linux Performance Monitoring IBM Wikis - AIX 5L Wiki - nmon A free tool to analyze AIX and Linux...

4. Shell Programming and Scripting

Alternatives utilities to rsync

Hi, I am using rsync to copy files and links from one server to other (backup server). The problem with rsync is that it is not copying the files and links in the order which i have mentioned. It is sorting in alphabetical order before it is copying the files and links. I want a utilty that...

5. Shell Programming and Scripting

ssh foo.com sudo command - Prompts for sudo password as visible text. Help?

I am writing a BASH script to update a webserver and then restart Apache. It looks basically like this: #!/bin/bash rsync /path/on/local/machine/ foo.com:path/on/remote/machine/ ssh foo.com sudo /etc/init.d/apache2 reloadrsync and ssh don't prompt for a password, because I have DSA encryption...

6. Shell Programming and Scripting

Sed -f alternatives?

I have a list of items (control file) that I want to substitute in a text file, and it's BIG. The file has two items, the original, and the new: A B B C D E The file has something like 10,000 entries. So in the oldfile.txt, I'd like to basically make all these expression matched...

7. UNIX for Advanced & Expert Users

SSH alternatives

Hi, I am using SSH to execute unix commands on remote machines. But, SSH will be diabled soon and I am looking for other alternatives to execute remote scripts/commands, without SSH . any suggestions or workarounds with out SSH for remote program executions ? Thanks in advance.

8. Shell Programming and Scripting

Alternatives to Expect

Are there any other alternatives to using Expect script? Can functionality provided by Expect be achieved by any other scripting language?

9. UNIX for Dummies Questions & Answers

Find command alternatives

Hi is there an alternative other than the find command to get the size of files which are 10 days older ? I already use a script with find command find . -mtime +10. However would want to have an alternative script to find the size of files which are over 10 days. Let me know if you...

10. Shell Programming and Scripting

Builtin alternatives for several commands?

I'm adapting a BASH script to run with an absolute minimal amounts of Cygwin64 files so colleagues using Windows can use it without installing Cygwin. I am down to the following in /bin only (replacing cut with parameter substitution eliminated all needed things in /etc) bash.exe cygattr-1.dll...

LEARN ABOUT DEBIAN

csp_helper

csp_helper(1)							  USER COMMANDS 						     csp_helper(1)

  NAME
      csp_helper - A collection of caspar helper scripts

  SYNOPSIS
      csp_install dir (directory) file (file)

      csp_mkdircp dir (directory) file (file)

      csp_scp_keep_mode h ([user@]host) dir (directory) file (file)

      csp_sucp h ([user@]host) dir (directory) file (file)

  DESCRIPTION
      The  scripts  csp_install,  csp_mkdircp,	csp_scp_keep_mode  and csp_sucp are helpers for caspar(7). These scripts typically are not invoked
      directly, but via a Makefile which uses caspar. See the notes on	csp_PUSH  in  caspar(7)  for  information  on  how  to	link  csp_install,
      csp_scp_keep_mode and csp_sucp to caspar.

  install DESCRIPTION
      csp_install creates the required directory (if needed) and installs the file, preserving timestamps. It uses install(1).

  install EXAMPLES
       csp_INSTALL_OPTIONS='--owner=www-data --group=www-data' 
	csp_INSTALL_MODE=ugo=r 
	csp_install /srv/www index.html

       csp_INSTALL_MODE=u=rwx,go= csp_install /usr/local/sbin mkpasswd

  install ENVIRONMENT
      csp_install honors csp_INSTALL_OPTIONS and csp_INSTALL_MODE (default is u=rw,go=r).

  mkdircp DESCRIPTION
      csp_mkdircp calls mkdir(1) and cp(1).

  scp_keep_mode DESCRIPTION
      csp_scp_keep_mode  uses  ssh to copy a file to a remote host, keeping its file permission mode. The trick used is a combination of mktemp(1)
      and mv(1).  Useful if you'd like to be sure a file gets installed e.g. group writable, without fiddling with permission bits on  the  remote
      host.

  scp_keep_mode EXAMPLE
	chmod g+w rc
	csp_scp_keep_mode root@gandalf /etc/uruk rc

  scp_keep_mode ENVIRONMENT
      csp_scp_keep_mode honors csp_SSH ("ssh" by default).

  sucp DESCRIPTION
      csp_sucp calls cat(1) from within sudo(1) from within ssh(1). This allows one to copy files to accounts on hosts one can only reach by call-
      ing sudo on the ssh-reachable remote host.

      Typically, one wants to install a root-owned file, but one does not want to allow access to the root-account directly  from  ssh.  Typically
      sudo is used as an extra line of defense.

  sucp EXAMPLES
      Some examples:

	csp_sucp rms@bilbo /etc fstab

	csp_sucp monty-python commit/ trailer.txt

  sucp BUGS
      If  NOPASSWD  is	not  set in the sudoers(5) file, and one's timestamp is expired, csp_sucp will forward the sudo password prompt. The given
      password will be echoed on the console!

  AUTHOR
      Joost van Baal-Ili

  SEE ALSO
      caspar(7) The caspar homepage is at http://mdcc.cx/caspar/ .

  csp_helper 20120514						      14 mai 2012						       csp_helper(1)

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

ASP alternatives

Discussion started by: Ricki

2. UNIX for Advanced & Expert Users

Alternatives for CLOCK_MONOTONIC

Discussion started by: amitks21

3. Linux

ntop/Nmon alternatives

Discussion started by: satimis

4. Shell Programming and Scripting

Alternatives utilities to rsync

Discussion started by: vvenu88