03-16-2007
restricting users privileges and logging their activities
Hello,
I'm administrating new installed cluster that runs Legato Networker and Oracle 9. And I want to restrict the use of root to my self and givr the application and DBA the proper and needed privileges to do their duties without hassle in addition I would like to log users activities.
my questions are:
1. is normal user will give the oracle dba and legato networker enough privileges to run the application specific command?
2. which is better in all terms sudo or RBAC?
3. do I have to enable BSM to log the users activities if I used RBAC or I can syslog do that?
Thank you
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hi!! Experts,
I have a typical scenario here in which several users have access to a particular login .. say "build".
None of the users know the passwd for this login.
The name of some of the user have been to .rhosts file.
The users can connect only by doing a rlogin to this id and then... (4 Replies)
Discussion started by: jyotipg
4 Replies
2. UNIX for Dummies Questions & Answers
Hello All!
Does anyone know of a nice way to log commands in solaris 8.
What I need is a program or script that saves any command that a user does in solaris command prompt. So when Steven logs in on a system, it should record everything he does, from an ls to exit with timestamps. I've been... (6 Replies)
Discussion started by: dozy
6 Replies
3. Linux
Hi.
I need the name for one command which I cant remember. This command displays all users which can log in to the system, wether they are stored in /etc/passwd, NIS og LDAP. Does anyone remember what command this is? (2 Replies)
Discussion started by: sprellari
2 Replies
4. AIX
What is the best way to logoff users from my Unix system? I have done a search and found that you can do a w or who - find who is on, and ps-ef | grep <user> and kill their processes. But what if you have a bunch of users and you need them off the system quickly? Killing individual processes... (1 Reply)
Discussion started by: outtacontrol
1 Replies
5. Solaris
I am looking for solutions to address my need to log to a file whenever a user logs out or session disconnects. (1 Reply)
Discussion started by: mhm4
1 Replies
6. UNIX for Advanced & Expert Users
I'm using vsftpd which is being controlled by inetd.
I have a user that I want to only be able to connect from one specific IP address on the same internal network so I can backup files on a separate system.
Is this possible with TCP wrappers? I got the notion that it was because of a few... (4 Replies)
Discussion started by: mashiox
4 Replies
7. Shell Programming and Scripting
Hi,
How do force users to log off Unix through shell? (2 Replies)
Discussion started by: Wahmed9
2 Replies
8. Shell Programming and Scripting
hi I need a shell script which runs perpetually in background and monitors different aspects of different users on different files and their usages
for example say there r 3 users
so i want when they log in i.e. their log in time and their file access, modify and change log of each file of a... (3 Replies)
Discussion started by: rrd1986
3 Replies
9. Shell Programming and Scripting
how can i make my users to not use particular commands in the network
like:wall.......
pl z help me regarding this (1 Reply)
Discussion started by: yashwanthguru
1 Replies
10. Red Hat
Hello,
can someone please provide steps, can I restrict a multiple users to only access only sftp on a server, to perform upload and download of files on their home directories.
1. I have updated their login shell as /sbin/nologin.
anything else do I need to update.
Thanks, (3 Replies)
Discussion started by: bobby320
3 Replies
LEARN ABOUT LINUX
sudo_root
sudo_root(8) System Manager's Manual sudo_root(8)
NAME
sudo_root - How to run administrative commands
SYNOPSIS
sudo command
sudo -i
INTRODUCTION
By default, the password for the user "root" (the system administrator) is locked. This means you cannot login as root or use su. Instead,
the installer will set up sudo to allow the user that is created during install to run all administrative commands.
This means that in the terminal you can use sudo for commands that require root privileges. All programs in the menu will use a graphical
sudo to prompt for a password. When sudo asks for a password, it needs your password, this means that a root password is not needed.
To run a command which requires root privileges in a terminal, simply prepend sudo in front of it. To get an interactive root shell, use
sudo -i.
ALLOWING OTHER USERS TO RUN SUDO
By default, only the user who installed the system is permitted to run sudo. To add more administrators, i. e. users who can run sudo, you
have to add these users to the group 'admin' by doing one of the following steps:
* In a shell, do
sudo adduser username admin
* Use the graphical "Users & Groups" program in the "System settings" menu to add the new user to the admin group.
BENEFITS OF USING SUDO
The benefits of leaving root disabled by default include the following:
* Users do not have to remember an extra password, which they are likely to forget.
* The installer is able to ask fewer questions.
* It avoids the "I can do anything" interactive login by default - you will be prompted for a password before major changes can happen,
which should make you think about the consequences of what you are doing.
* Sudo adds a log entry of the command(s) run (in /var/log/auth.log).
* Every attacker trying to brute-force their way into your box will know it has an account named root and will try that first. What they do
not know is what the usernames of your other users are.
* Allows easy transfer for admin rights, in a short term or long term period, by adding and removing users from the admin group, while not
compromising the root account.
* sudo can be set up with a much more fine-grained security policy.
* On systems with more than one administrator using sudo avoids sharing a password amongst them.
DOWNSIDES OF USING SUDO
Although for desktops the benefits of using sudo are great, there are possible issues which need to be noted:
* Redirecting the output of commands run with sudo can be confusing at first. For instance consider
sudo ls > /root/somefile
will not work since it is the shell that tries to write to that file. You can use
ls | sudo tee /root/somefile
to get the behaviour you want.
* In a lot of office environments the ONLY local user on a system is root. All other users are imported using NSS techniques such as
nss-ldap. To setup a workstation, or fix it, in the case of a network failure where nss-ldap is broken, root is required. This tends to
leave the system unusable. An extra local user, or an enabled root password is needed here.
GOING BACK TO A TRADITIONAL ROOT ACCOUNT
This is not recommended!
To enable the root account (i.e. set a password) use:
sudo passwd root
Afterwards, edit the sudo configuration with sudo visudo and comment out the line
%admin ALL=(ALL) ALL
to disable sudo access to members of the admin group.
SEE ALSO
sudo(8), https://wiki.ubuntu.com/RootSudo
February 8, 2006 sudo_root(8)