Sudoers


 
Thread Tools Search this Thread
Operating Systems Solaris Sudoers
# 1  
Old 05-19-2017
Sudoers

Having a bit of a discussion with a software vendor about this. Can anyone confirm my understanding?

/etc/sudoers file example:-

Code:
user1 server1 = NOPASSWD:/usr/bin/ls -l
user1 server1 = NOPASSWD:/usr/bin/file

But then the following command fails (logged in on server 1 as user1) because its not in sudoers file.

Code:
sudo java abc.jar

Surely this is correct? You can't sudo a command unless you have appropriate permissions in /etc/sudoers? Am I right?
# 2  
Old 05-19-2017
Yes, you have granted user1 the privilege to use sudo and run ls -l and /usr/bin/file only. Everything else would be rejected.

You would need a line that allows user1 to run java, so you are correct.


Kind regards,
Robin
# 3  
Old 05-19-2017
Code:
sudo java abc.jar

I'd recommend being really careful about what's in abc.jar and/or which abc.jar the user is allowed to run under sudo.

Because anyone who knows even a little Java programming will be able to create a JAR file that does anything they want. Allowing sudo access to Java is awfully close to giving the users full access to root if they want it.

You're probably a lot better off writing a wrapper script, limiting write access to that script to root only, making sure the environment variables are all clean, and then giving sudo access to that wrapper script instead of allowing sudo to run Java directly.
These 2 Users Gave Thanks to achenle For This Post:
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Sudoers file

In the sudoers file in Solaris... I am trying to limit the DEVELOPER user privileges to where those users can only use the “rm” command in certain directories. This is to prevent them from deleting directories or files and destroying a server. I want them to be able to use the "rm" command but... (1 Reply)
Discussion started by: nzonefx
1 Replies

2. Linux

Sudoers in Centos

In our servers we don't have proper groups and No active Directory. We are adding Users locally and providing users a public key, that's the way they can connect to the servers using .ppk file. My manager ask me to prompt for a password based login when they try for Sudo. (Currently it was set... (1 Reply)
Discussion started by: shekar777
1 Replies

3. UNIX for Dummies Questions & Answers

Help with Sudoers file

Hi using Solaris 10. trying to update /etc/sudoers file I need to add all the fist level operation team. This is what I have but it doesn't seem to work. Please help.Error message sudo su - >>> sudoers file: parse error, line 9 <<< >>> sudoers file: parse error, line 9 <<< ... (2 Replies)
Discussion started by: samnyc
2 Replies

4. HP-UX

sudo/sudoers

Dear folks. Considering PCIDSS standards, i have requirment to use sudo(ers) to log everything a certain user executes with root privileges. Now, for an admin it's just a pain in the ass to prefix every command with sudo. Only way i can think of is making .aliases and with some awk magic... (6 Replies)
Discussion started by: Peasant
6 Replies

5. Solaris

sudoers

what is the configuration file for sudo? can we edit it as like other file or will it create any adverse effect on editing that file? thanks in advance dinu (1 Reply)
Discussion started by: dinu
1 Replies

6. Solaris

sudoers

this is for the first time i am going to use sudoers i want know how to create sudoers and giving privileges for that users thanks in advance dinu (6 Replies)
Discussion started by: dinu
6 Replies

7. UNIX for Advanced & Expert Users

sudoers file

i have defined a rule in the sudoers file so a specific user is able to run some commands as sudo with no password. my question is: is it possible to restrict a user to run commands as sudo only in a certain directory? for example: chown only the files that are located in /var/tmp. Thank you. ... (2 Replies)
Discussion started by: noam128
2 Replies

8. UNIX for Dummies Questions & Answers

sudoers

i just installed/configured apache2.0 on my own aix5.3 mini server. i can start/stop apache by root, but i want to start it under my login id(admin) instead. i need to execute this command: /usr/bin/sudo /usr/IBM/HTTPServer/bin/apachectl stop/start. (5 Replies)
Discussion started by: tjmannonline
5 Replies

9. UNIX for Advanced & Expert Users

Usernames in Sudoers have #

We have users that have a # in their username. Sudo is working on some servers and not others. I have narrowed it down to the # in their username. Any suggestions or ideas why it is working on 1 server but not another. Server not working is - Solaris 10 patch level 138888-01 Server working is ... (1 Reply)
Discussion started by: Gibby13
1 Replies

10. UNIX for Dummies Questions & Answers

sudoers on HP 11.11

Having a "running low on coffee" moment here & need help. On HP 11.11 where is the sudoers file located; I looked every place I could think of and don't see it. Thanks in advance:confused: (2 Replies)
Discussion started by: dhlopomo
2 Replies
Login or Register to Ask a Question