01-30-2011
Yes it can be done and be secure. I done a couple and basically here was my approach.
1. Create the central users script. If needed the make menu driven. We created a base user not a super user for this account. In out case the home dir is a NFS mount to all the servers. So a script to send commands to another server wasn't needed. A NAS mounted device would work for this also.
2. So since in most cases root needs to be the user to do the work.
I have a local root script that is looping and looking for a file to show up in a defined directory on the global mount. Now this is were it depends on what you are trying to do on the server. So the dropped file
could contain the objective to be bounce. So if you would bounce oracle and refresh sendmail lets say. the file would be named <server name>_???.trg and contain oracle|sendmail. The local script would see the file then consume the file and create a results file.
3. the master script would look for the files to be consumed and the results being created.
There are a lot more steps to all this...
Security wise - since the user login into the server as the service user. They don't know or have ability to be root. That is all controlled by the scripts and your programs. And the service account when it logs in will only run the menu to do your application. And you will also do the trap command in the login control so they can't ctl c or anything out to a shell.
This may sound worse than what the work really is. You could have the whole thing done in a day or so.
10 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
I would like to allow only one instance of a script to run at any moment.
I've tried the following solution to count the instances but the result is always the number of running instances plus one and I can't find the problem
ps -ef | grep $0 | sed '/^$/ d' | sed '/grep/ d' | wc -l
Please... (2 Replies)
Discussion started by: oti
2 Replies
2. UNIX for Advanced & Expert Users
I have the below code in a file called test.ksh and it is scheduled using cron forevery 5 min. when i see the cron out file for every 5 min it showing the no of process running are 2. same thing when i implement in another script which contains other code along with the below code , it showing as... (1 Reply)
Discussion started by: kamesh83
1 Replies
3. Shell Programming and Scripting
Hello,
I'm trying to write a script that checks for previous instances of the same script which may still be running (this script is scheduled to run every 30 minutes). I want to somehow use the pid from each instance to make sure the previous one isn't running before continuing with my... (5 Replies)
Discussion started by: bd_joy
5 Replies
4. Shell Programming and Scripting
Hi,
Please let us know how to create a multiple instances of a job in the shell script.
Thanks.
Gangegowda K.G (1 Reply)
Discussion started by: Gangegowda
1 Replies
5. Shell Programming and Scripting
Can I get the STATE(instance are RUNNING or not and HEALTH is OK or not) of the weblogic instances(Admin and Managed) running on my unix machine via shell script.
Someone told me that it can be done via "weblogic.Admin GETSTATE"....but it is not working for me(might be I am doing something wrong)... (2 Replies)
Discussion started by: joshilalit2004
2 Replies
6. Shell Programming and Scripting
Hello,
My goal is to run the same Shell script in a parallel mode. This script will get triggered from different machines and different application teams by some job scheduling tool.
They may trigger the process at the same time. so I want to have them in QUEUE ..and release them for execution on... (3 Replies)
Discussion started by: chetan_sonar
3 Replies
7. UNIX for Advanced & Expert Users
just wanted to ask if anybody have script template for the subject above so I can make ti as my guide? example
a. server 1.1.1.1: restart script located at /etc/init.d/glassfish.sh
b. server 2.2.2.2: central script that support admin will use to execute to restart the /etc/init.d/glassfish.sh... (0 Replies)
Discussion started by: lhareigh890
0 Replies
8. Shell Programming and Scripting
How we can run the multiple instances of the script? I need to run the script which I am calling from the below function.I can doit with cron but I don't want to put it in the cron.This cript dploy the build and here I want when the build stage then it should run with multilpe instances of... (6 Replies)
Discussion started by: anuragpgtgerman
6 Replies
9. Solaris
Hi everyone,
I have a Solaris machine:
SunOS 5.10 Generic_127127-11 sun4v sparc SUNW,SPARC-Enterprise-T5220
After reboot, I can't ssh to this machine. Error message:
ssh: connect to host xxxx port 22: Connection refused
It seems ssh daemon is not running, but I don't have... (5 Replies)
Discussion started by: Zaiwen Gong
5 Replies
10. Shell Programming and Scripting
Hello,
I know this is not a simple question so I just need to know where to start for below project:
I am running under Ubuntu 18.04
What I'd like to see in apache page is to display status of particular process pids.
ps aux | grep keywords.txt
keywords.txt
word1
word2
word3
word4... (9 Replies)
Discussion started by: baris35
9 Replies
SETUID(1) General Commands Manual SETUID(1)
NAME
setuid - run a command with a different uid.
SYNOPSIS
setuid username|uid command [ args ]
DESCRIPTION
Setuid changes user id, then executes the specified command. Unlike some versions of su(1), this program doesn't ever ask for a password
when executed with effective uid=root. This program doesn't change the environment; it only changes the uid and then uses execvp() to find
the command in the path, and execute it. (If the command is a script, execvp() passes the command name to /bin/sh for processing.)
For example,
setuid some_user $SHELL
can be used to start a shell running as another user.
Setuid is useful inside scripts that are being run by a setuid-root user -- such as a script invoked with super, so that the script can
execute some commands using the uid of the original user, instead of root. This allows unsafe commands (such as editors and pagers) to be
used in a non-root mode inside a super script. For example, an operator with permission to modify a certain protected_file could use a
super command that simply does:
cp protected_file temp_file
setuid $ORIG_USER ${EDITOR:-/bin/vi} temp_file
cp temp_file protected_file
(Note: don't use this example directly. If the temp_file can somehow be replaced by another user, as might be the case if it's kept in a
temporary directory, there will be a race condition in the time between editing the temporary file and copying it back to the protected
file.)
AUTHOR
Will Deich
local SETUID(1)