07-11-2014
Quote:
Would the configuration allow userA to SU to root and then SU into all other accounts??
Yes it would. But since root virtually owns everything anyway, once somebody has root access they own the entire box. So why worry about going into another account, other than to cause problems with email masquerading or something like that?
Giving root the way you did is a terrible idea. The idea behind sudo is 'least privilege' - give UserA just the access they need, absolutely nothing more.
10 More Discussions You Might Find Interesting
1. Solaris
I just need to know what should be done on a login user so that no one can access it except through sudo
i.e.
telnet server
login: user
NO ACCESS
telnet server
login: mylogin
sudo - user <any command>
ACCESS GRANTED
thanks (0 Replies)
Discussion started by: melanie_pfefer
0 Replies
2. Linux
Hi All,
I got lots of request with sudo, a manager request, verbal command, do this and do that.
The problem with this kind of request is when I added that script and that. It will not be perfect, it's because I can't verify the userid sudo access, I can't reset their password as well, I... (2 Replies)
Discussion started by: itik
2 Replies
3. AIX
I have installed sudo on AIX 6100-04 and want to know how do I set it up for a user to be able to run only some commands? I want to give the user the rights to only cd to certain directories and run the ls command to name a few? Are there any issues with running sudo when the user is forced to... (2 Replies)
Discussion started by: daveisme
2 Replies
4. Shell Programming and Scripting
Hello All,
I want to create a script that will do ONLY su to any user on the server with hpadmin login using sudo. Can anyone let me know how can it do it.
Regards
Ankit (1 Reply)
Discussion started by: ajaincv
1 Replies
5. UNIX for Dummies Questions & Answers
I'm actually working with a Ubuntu-System here and have a question about executing a command with 'sudo'.
I tried and got a error message like "not allowed".
After this I logged in with 'sudo -s' and typed the command without 'sudo'. This worked well.
Can please somebody explain me this... (0 Replies)
Discussion started by: daWonderer
0 Replies
6. Ubuntu
Linux ubuntu 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
Hi Folks,
Please help me. I am bit struck here.
Here is the OS info.
Linux ubuntu 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
I have a... (17 Replies)
Discussion started by: explorer007
17 Replies
7. UNIX for Advanced & Expert Users
I want to give root access to a user called denielr on server - tsprd01, but do not want to share root password. I have sudoers configured already.
He should have all access equal to root. I made this entry in /etc/sudoers, but it is not working
denielr tsprd01 =(root) NOPASSWD: ALL
I tried to... (2 Replies)
Discussion started by: solaris_1977
2 Replies
8. Solaris
Install the sudo pkg SFWsudo.tar
bash#tar -xvf SFWsudo.tar
bash#pkgadd -d . SFWsudo
path may be /opt/sfw/bin
Make entry the user name in sudoer file
path of the sudoer file
/opt/sfw/etc/sudoers
check with the below command as a user (not as a root user)
user1$... (1 Reply)
Discussion started by: Narendiran
1 Replies
9. Red Hat
Hi,
I have given access to user mwadmin in shudders file as :
mwadmin ALL:NOPASSWD:/www/* /usr/* /opt/*
However, not able to execute below command:
sudo mkdir -p /usr/test
password for mwadmin:
Sorry, user mwadmin is not allowed to execute '/bin/mkdir -p /usr/test' as root.
... (4 Replies)
Discussion started by: saurau
4 Replies
10. Shell Programming and Scripting
I have similar issue as mentioned in
167174-how-run-script-using-batch-file.html
It works good, but the control is not coming back to source i tried adding exit to remote script.
Thanks,
Suresh (0 Replies)
Discussion started by: snsuresh
0 Replies
LEARN ABOUT CENTOS
pam_wheel
PAM_WHEEL(8) Linux-PAM Manual PAM_WHEEL(8)
NAME
pam_wheel - Only permit root access to members of group wheel
SYNOPSIS
pam_wheel.so [debug] [deny] [group=name] [root_only] [trust] [use_uid]
DESCRIPTION
The pam_wheel PAM module is used to enforce the so-called wheel group. By default it permits root access to the system if the applicant
user is a member of the wheel group. If no group with this name exist, the module is using the group with the group-ID 0.
OPTIONS
debug
Print debug information.
deny
Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of
the group option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE (unless trust was also specified, in
which case we return PAM_SUCCESS).
group=name
Instead of checking the wheel or GID 0 groups, use the name group to perform the authentication.
root_only
The check for wheel membership is done only.
trust
The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play
stacking the modules the wheel members may be able to su to root without being prompted for a passwd).
use_uid
The check for wheel membership will be done against the current uid instead of the original one (useful when jumping with su from one
account to another for example).
MODULE TYPES PROVIDED
The auth and account module types are provided.
RETURN VALUES
PAM_AUTH_ERR
Authentication failure.
PAM_BUF_ERR
Memory buffer error.
PAM_IGNORE
The return value should be ignored by PAM dispatch.
PAM_PERM_DENY
Permission denied.
PAM_SERVICE_ERR
Cannot determine the user name.
PAM_SUCCESS
Success.
PAM_USER_UNKNOWN
User not known.
EXAMPLES
The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non-root applicants.
su auth sufficient pam_rootok.so
su auth required pam_wheel.so
su auth required pam_unix.so
SEE ALSO
pam.conf(5), pam.d(5), pam(8)
AUTHOR
pam_wheel was written by Cristian Gafton <gafton@redhat.com>.
Linux-PAM Manual 09/19/2013 PAM_WHEEL(8)