09-09-2009
thankz radar and tigta09
Hi
I found the solution not exactly up to the point but will like to share.
This is what I did(logged in as a root)
1) Added a group : groupadd netadmins
2) Added a user : useradd admin1
3) Gave a password for admin1 : passwd admin1
4) Added admin1 as a member of group netadmins : usermod -g netadmins admin1
5) Edited /etc/sudoers : vi /etc/sudoers
added two lines
1st
#added this just after the "Cmnd_Alias NETWORKING decleration"
Cmnd_Alias TIGHTNETWORKING = /sbin/ifconfig, /bin/ping
2nd
#added this just after the "root ALL=(ALL) ALL"
%netadmins ALL = (ALL) NOPASSWD:TIGHTNETWORKING
saved the file with "wq!" as sudoers is a readonly file!
---------------------------------------------------------------------
The result
logged off from root, logged in as admin1.
executed the ifconfig and ping using sudo
[admin1@177 ~] sudo /sbin/ifconfig eth0 up
It worked out fine.
[admin1@177 ~] sudo /bin/ping x.x.x.x
This worked on fine and I later realized that ping works without sudo too.
This solved a major part of my problem i.e. now a non admin user can execute 'ifconfig' if the user
is a part of 'netadmins'.
Now does anyone has an idea how to disable all the other commands including "ll ls pwd ....etc etc"
Thankz in advance.
10 More Discussions You Might Find Interesting
1. Cybersecurity
A few of the other employees here need to learn "vi" in order to use crontab to schedule / unschedule jobs on one of our production servers. I tried to set up a login on one of my Linux boxes for them to use "vimtutor", but scrapped it and decided to try for something more secure, since there are... (1 Reply)
Discussion started by: LivinFree
1 Replies
2. Solaris
Hi, all,
I need to add a user to our system in order to let him use Oracle and Perl. We want him to remain in his home directory and have no access to our data and other users' files.
I created a separate group for this user, and set his shell to rksh when I created his account, by which he... (2 Replies)
Discussion started by: alanlh
2 Replies
3. Shell Programming and Scripting
Hi,
I need to provide execute access to certain users and not to all users
For ex: if ther is a file /home/august/aug.sh.
and there are user's like jan,feb,mar,april,May and jan is the owner of that box. I need to provide execute access to feb and mar only. I also know the root pwd for... (3 Replies)
Discussion started by: Ashok_oct22
3 Replies
4. AIX
Hi,
We have Oracle Database on AIX 5.3 server.We want to give ftp access to a user to a specific folder.He should be able to put and get files from that specific folder only.Moreover he should not be able to cd to any other filesystems also along with root directory.
Please note that as per... (1 Reply)
Discussion started by: dwiravi
1 Replies
5. UNIX for Dummies Questions & Answers
Hi All ,
Some of the users should be restricted using the MV commands on some of the standard folders. We had an issue the other day like from the standard folder structure which was set up one of the user has moved a folder to a different location and the jobs failed as the folder was not... (6 Replies)
Discussion started by: perlamohan
6 Replies
6. Solaris
Hi,
What is the command or how to create a user with the restricted usage of space on a disk.
Also let me know how to change the limit of the space size allotted in future for the same user.
~Vinodh Kumar V M (3 Replies)
Discussion started by: vino_hymi
3 Replies
7. Solaris
I have solaris 10 os 64 bit.
I need to create a restricted user which has the following command to run
ls
df and du
list crontab of root and edit crontab of root also
please help (2 Replies)
Discussion started by: reyazan
2 Replies
8. AIX
Hello everyone
I need to create a restricted user or a special user. Here is what I need.
I have this path
next to profiles I have server1, server2, server3.......
The user that I have to create I need that he can move between server1. server2, server3 because in every one have logs... (1 Reply)
Discussion started by: lo-lp-kl
1 Replies
9. Red Hat
hi everybody,
iam using 32bit centos 6.2 on my machine, and i want to create hidden user 'test' , i mean to say while iam starting my centos at GUI mode, at that time that username 'test' should not appear at list of users, only i can use that username is command line. logging in through... (1 Reply)
Discussion started by: paruhang
1 Replies
10. Debian
want to create a user account for each of the key programs installed on my debian server. For example, for the following programs:
Tomcat Nginx Supervisor PostgreSQL
This seems to be recommended based on my reading online. However, I want to restrict these user accounts as much as possible,... (3 Replies)
Discussion started by: Spadez
3 Replies
LEARN ABOUT LINUX
sudo_root
sudo_root(8) System Manager's Manual sudo_root(8)
NAME
sudo_root - How to run administrative commands
SYNOPSIS
sudo command
sudo -i
INTRODUCTION
By default, the password for the user "root" (the system administrator) is locked. This means you cannot login as root or use su. Instead,
the installer will set up sudo to allow the user that is created during install to run all administrative commands.
This means that in the terminal you can use sudo for commands that require root privileges. All programs in the menu will use a graphical
sudo to prompt for a password. When sudo asks for a password, it needs your password, this means that a root password is not needed.
To run a command which requires root privileges in a terminal, simply prepend sudo in front of it. To get an interactive root shell, use
sudo -i.
ALLOWING OTHER USERS TO RUN SUDO
By default, only the user who installed the system is permitted to run sudo. To add more administrators, i. e. users who can run sudo, you
have to add these users to the group 'admin' by doing one of the following steps:
* In a shell, do
sudo adduser username admin
* Use the graphical "Users & Groups" program in the "System settings" menu to add the new user to the admin group.
BENEFITS OF USING SUDO
The benefits of leaving root disabled by default include the following:
* Users do not have to remember an extra password, which they are likely to forget.
* The installer is able to ask fewer questions.
* It avoids the "I can do anything" interactive login by default - you will be prompted for a password before major changes can happen,
which should make you think about the consequences of what you are doing.
* Sudo adds a log entry of the command(s) run (in /var/log/auth.log).
* Every attacker trying to brute-force their way into your box will know it has an account named root and will try that first. What they do
not know is what the usernames of your other users are.
* Allows easy transfer for admin rights, in a short term or long term period, by adding and removing users from the admin group, while not
compromising the root account.
* sudo can be set up with a much more fine-grained security policy.
* On systems with more than one administrator using sudo avoids sharing a password amongst them.
DOWNSIDES OF USING SUDO
Although for desktops the benefits of using sudo are great, there are possible issues which need to be noted:
* Redirecting the output of commands run with sudo can be confusing at first. For instance consider
sudo ls > /root/somefile
will not work since it is the shell that tries to write to that file. You can use
ls | sudo tee /root/somefile
to get the behaviour you want.
* In a lot of office environments the ONLY local user on a system is root. All other users are imported using NSS techniques such as
nss-ldap. To setup a workstation, or fix it, in the case of a network failure where nss-ldap is broken, root is required. This tends to
leave the system unusable. An extra local user, or an enabled root password is needed here.
GOING BACK TO A TRADITIONAL ROOT ACCOUNT
This is not recommended!
To enable the root account (i.e. set a password) use:
sudo passwd root
Afterwards, edit the sudo configuration with sudo visudo and comment out the line
%admin ALL=(ALL) ALL
to disable sudo access to members of the admin group.
SEE ALSO
sudo(8), https://wiki.ubuntu.com/RootSudo
February 8, 2006 sudo_root(8)