sudo - User privilege specification Post: 302587088

Sponsored Content

Operating Systems AIX sudo - User privilege specification Post 302587088 by admin_xor on Wednesday 4th of January 2012 05:07:14 AM

01-04-2012

Registered User

Well I can give you an example how I setup command alias in /etc/sudoers file for our ID Administration team. This is what it looks like:

Code:

Cmnd_Alias      IDADMIN=/usr/bin/mkuser, /usr/bin/chuser, /usr/sbin/rmuser, \
                /usr/bin/passwd [0-9]*, /usr/bin/passwd [A-z]* ,\
                !/usr/bin/passwd root, \
                /usr/bin/chsec, /usr/bin/mkgroup, /usr/sbin/rmgroup, \
                /home/comadm/passwd_lastupdate.pl, \
                /usr/bin/ls, /usr/bin/chmod, /usr/bin/chown, /usr/bin/chgrp, \
                /usr/bin/find, /usr/sbin/lsuser, /usr/bin/vi /etc/ftpusers, \
                /usr/local/bin/generate_user_file_list, \
                /usr/local/bin/remove_user_files, /usr/bin/cat, \
                /usr/bin/rm -f /var/spool/mail/*, \
                ! /usr/bin/rm -f /var/spool/mail/root, \
                /usr/bin/rm -f /var/spool/cron/crontabs/*, \
                ! /usr/bin/rm -f /var/spool/cron/crontabs/root, \
                /usr/bin/rm -f /var/spool/cron/atjobs/*, \
                /usr/bin/rm -rf /home/*, /usr/bin/pwdadm, /usr/bin/smitty user

With command alias you can not only create positive set of list but also you can specify what they cannot do using sudo (as opposed to what zaxxon said, note the exclamatory sign in front of commands which are being restricted).

Hope you get an idea on how to set up /etc/sudoers

This User Gave Thanks to admin_xor For This Post:

admin_xor

View Public Profile for admin_xor

Find all posts by admin_xor

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Write privilege for user

Is it possible to grant write privileges to a user on a directory with out having to add the user to a group or make the user the owner of the directory? My background is in Windows and in Windows you can grant specific privileges to a user without having to put the user in a group or making the...

2. AIX

[Help] Give privilege to an ordinary user

I'm trying to give a non-root user the right to start IBM HTTP Server, the web server is listening on port 80, but for AIX, ports under 1024 are privilege ports which can be used only by root. /usr/IBMIHS/bin# ./apachectl start (13)Permission denied: make_sock: could not bind to address :::80...

3. Solaris

Root privilege for user

Can anyone please tell how to give root privilege to a normal user in solaris 10?

4. UNIX for Dummies Questions & Answers

How to create/restrict a user with to have no privilege from other group

Hello experts I am new to Unix. Env : HPUX I need to create a user say testuser such that it does not have access to file/directories from the other group i.e the last 3 digits . How do I do that. Reason for such a request :- I have an existing user oracle which has default umask...

5. AIX

User Privilege

How to assign superuser privilege to an ordinary user temporarily

6. Red Hat

Save sudo privilege for session

I have setup public key based login to my CentOS VPS. I wish to disable direct root login and have created an admin user under wheel group and have modified /etc/sudoers file and gave Wheel group all privileges. But now I am being prompted for password whenever I type sudo. I do not wish to...

7. Cybersecurity

sudo - AIX - User privilege specification

I am planning to implement sudo for users. Under , it looks I have to put the users who need to have sudo access: What are the recommended for users? I don't think I need to give the ALL privilege (i.e ) to AIX users. I'd like to know the commonly used privilege specification for sudo...

8. Shell Programming and Scripting

Create user with different privilege

Hi , I want to create 3 different user with below privilege in Solaris and Linux. 1) Read Only 2)Read and Write Only 3) Admin user Can you guys help me on this .

9. Solaris

Assigning proc_owner privilege to particular user in RBAC

Hi I need to assign proc_owner privilege to particular user through RBAC. How can I assign this privilege to user, I need help on this. Further I need to understand if I give this proc_owner privilege to particular user, what kind of control user will get on other user or system processes...

LEARN ABOUT SUNOS

getusershell

getusershell(3C)					   Standard C Library Functions 					  getusershell(3C)

NAME

       getusershell, setusershell, endusershell - get legal user shells

SYNOPSIS

       #include <unistd.h>

       char *getusershell(void);

       void setusershell(void);

       void endusershell(void);

DESCRIPTION

       The  getusershell()  function  returns  a  pointer  to  a  legal  user  shell  as defined by the system manager in the file /etc/shells. If
       /etc/shells does not exist, the following locations of the standard system shells are used in its place:

       /bin/bash		  /bin/csh
       /bin/jsh 		  /bin/ksh
       /bin/pfcsh		  /bin/pfksh
       /bin/pfsh		  /bin/sh
       /bin/tcsh		  /bin/zsh
       /sbin/jsh		  /sbin/pfsh
       /sbin/sh 		  /usr/bin/bash
       /usr/bin/csh		  /usr/bin/jsh
       /usr/bin/ksh		  /usr/bin/pfcsh
       /usr/bin/pfksh		  /usr/bin/pfsh
       /usr/bin/sh		  /usr/bin/tcsh
       /usr/bin/zsh		  /usr/xpg4/bin/sh

       The getusershell() function opens the file /etc/shells, if it exists, and returns the next entry in the list of shells.

       The setusershell() function rewinds the file or the list.

       The endusershell() function closes the file, frees any memory used by getusershell() and setusershell(), and rewinds the file /etc/shells.

RETURN VALUES

       The getusershell() function returns a null pointer on EOF.

BUGS

       All information is contained in memory that may be freed with a call to endusershell(), so it must be copied if it is to be saved.

SunOS 5.10							    30 Aug 2004 						  getusershell(3C)