03-16-2011
Are you aware that Solaris has RBAC (Role-Based Access Control) built in? This gives you much finer control that sudo.
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Having a "running low on coffee" moment here & need help.
On HP 11.11 where is the sudoers file located; I looked every place I could think of and don't see it.
Thanks in advance:confused: (2 Replies)
Discussion started by: dhlopomo
2 Replies
2. UNIX for Advanced & Expert Users
We have users that have a # in their username. Sudo is working on some servers and not others. I have narrowed it down to the # in their username. Any suggestions or ideas why it is working on 1 server but not another.
Server not working is - Solaris 10 patch level 138888-01
Server working is ... (1 Reply)
Discussion started by: Gibby13
1 Replies
3. UNIX for Dummies Questions & Answers
i just installed/configured apache2.0 on my own aix5.3 mini server. i can start/stop apache by root, but i want to start it under my login id(admin) instead.
i need to execute this command:
/usr/bin/sudo /usr/IBM/HTTPServer/bin/apachectl stop/start. (5 Replies)
Discussion started by: tjmannonline
5 Replies
4. UNIX for Advanced & Expert Users
i have defined a rule in the sudoers file so a specific user is able to run some commands as sudo with no password.
my question is: is it possible to restrict a user to run commands as sudo only in a certain directory? for example: chown only the files that are located in /var/tmp.
Thank you.
... (2 Replies)
Discussion started by: noam128
2 Replies
5. Solaris
what is the configuration file for sudo? can we edit it as like other file or will it create any adverse effect on editing that file?
thanks in advance
dinu (1 Reply)
Discussion started by: dinu
1 Replies
6. HP-UX
Dear folks.
Considering PCIDSS standards, i have requirment to use sudo(ers) to log everything a certain user executes with root privileges.
Now, for an admin it's just a pain in the ass to prefix every command with sudo.
Only way i can think of is making .aliases and with some awk magic... (6 Replies)
Discussion started by: Peasant
6 Replies
7. UNIX for Dummies Questions & Answers
Hi
using Solaris 10. trying to update /etc/sudoers file
I need to add all the fist level operation team. This is what I have but it doesn't seem to work. Please help.Error message
sudo su -
>>> sudoers file: parse error, line 9 <<<
>>> sudoers file: parse error, line 9 <<<
... (2 Replies)
Discussion started by: samnyc
2 Replies
8. Linux
In our servers we don't have proper groups and No active Directory.
We are adding Users locally and providing users a public key, that's the way they can connect to the servers using .ppk file.
My manager ask me to prompt for a password based login when they try for Sudo. (Currently it was set... (1 Reply)
Discussion started by: shekar777
1 Replies
9. Solaris
In the sudoers file in Solaris...
I am trying to limit the DEVELOPER user privileges to where those users can only use the “rm” command in certain directories. This is to prevent them from deleting directories or files and destroying a server. I want them to be able to use the "rm" command but... (1 Reply)
Discussion started by: nzonefx
1 Replies
10. Solaris
Having a bit of a discussion with a software vendor about this. Can anyone confirm my understanding?
/etc/sudoers file example:-
user1 server1 = NOPASSWD:/usr/bin/ls -l
user1 server1 = NOPASSWD:/usr/bin/file
But then the following command fails (logged in on server 1 as user1) because... (2 Replies)
Discussion started by: psychocandy
2 Replies
LEARN ABOUT DEBIAN
gradm2
GRADM(8) System Manager's Manual GRADM(8)
NAME
gradm - Administration program for the grsecurity RBAC system
SYNOPSIS
gradm [ -E ] [ -R ] [ -C ] [ -F ] [ -L <logfile> ] [ -O <filename|stream> ] [ -M <filename|uid> ] [ -D ] [ -P [rolename] ] [ -a <rolename>
] [ -n <rolename> ] [ -p <rolename> ] [ -u ] [ -V ] [ -h ] [ -v ]
DESCRIPTION
gradm is the userspace RBAC parsing and authentication program for grsecurity
grsecurity aims to be a complete security system for Linux 2.4. gradm performs several tasks for the RBAC system including authenticated
via a password to the kernel and parsing rules to be passed to the kernel.
OPTIONS
All options to gradm are mutually exclusive, except for -L and -O.
-E Enable the RBAC system
-R Reload the RBAC system (only valid while in admin mode)
-C Perform a check of the RBAC policy, running the same analysis against it that is performed when enabling.
-F Toggle full learning mode. If used only with -L, it enables the RBAC system in full learning mode. If used with -L and -O, it
parses the full learning logs and generates a complete ruleset.
-M <filename|uid>
Remove an execution ban on a given uid or filename that has been put in place by the RES_CRASH resource restriction of the RBAC sys-
tem.
-L <logfile>
Parses the learning logs. Accepts an argument which specifies the logfile to scan for the learning logs. If "-" is specified as
the logfile, stdin will be used as the learning log. This option can be used with -E, -O, or -F.
-O <filename|stream>
Specifies output mode. Requires a single argument that can be "stdout", "stderr", or a regular file. Only used with -L or -F.
-D Disable the RBAC system
-P [rolename]
Without an argument, it sets the password for administering the RBAC system. With a role name as an argument, it sets the password
for that given special role.
-a <rolename>
Authenticate to a special role that requires a password.
-n <rolename>
Authenticate to a special role that does not require a password.
-p <rolename>
Authenticate through PAM to a special role.
-u Removes yourself from your current special role, reverting back to the normal role selection. To be used, for instance, for logging
out of an admin role without exiting your shell.
-V Displays verbose policy statistics when enabling the RBAC system or checking the RBAC policy. Can only be used with -C, -E, or -F
-L <filename>
-h Display help information
-v Print version information and exit
REPORTING BUGS
Please include as much information as possible(using any available debugging options) and send bug reports for gradm or the grsecurity RBAC
system to spender@grsecurity.net.
AUTHOR
grsecurity and gradm were created and are maintained by Brad Spengler <spender@grsecurity.net>
GRADM(8)