Sponsored Content
Operating Systems Linux Red Hat Sudo to user other than root but do not allow sudo to root Post 302933964 by westmoreland on Tuesday 3rd of February 2015 11:47:47 AM
Old 02-03-2015
Sudo to user other than root but do not allow sudo to root

I have a set of RHEL 5 boxes running our ERP software on Oracle databases. I need to allow my DBA's to su to oracle and one other account (banner) without knowing the oracle or banner password. But I need to prevent them from su'ing to any other user especially root. I only want them to be able to switch to the oracle user or the banner user. I've recreate the accounts on a test system to try and work through my confusion and better understand how to use sudo before implementing it on my production systems.

Typically the user changes to these accounts like this:

Code:
>sudo su - oralce

They are then prompted to enter their own password and it lets them in. The problem is that they can use the command to become root, or any other user, as well.

I have a group on my system (enterpriseapps) which contains the users I want to grant access to. I edited my /etc/sudoers file. Here's how it looks:


Quote:
User_Alias DBA = %enterpriseapps
Runas_Alias ORACLE = oracle, banner
#Cmnd_Alias SU = !/bin/su -, !/bin/su *root*, !/usr/bin/su -, !/usr/bin/su *root*, /usr/bin/su - oracle, /usr/bin/su - banner, /bin/su - oracle, /bin/su - banner
Cmnd_Alias SU = /usr/bin/su - oracle, /usr/bin/su - banner, /bin/su - oracle, /bin/su - banner

%sysadmin ALL=(ALL) ALL
DBA ALL=(ORACLE) NOPASSWD: SU
So, if I understand it correctly, users in the DBA User_Alias should be able to run from any system (ALL) as users in the ORACLE Runas_Alias with NOPASSWD and they should only be able to run the commands in the SU Cmnd_Alias. Of course, I have my sysadmin group setup so that they can become root.

So I configured my Cmnd_Alias two different ways but they both give me same result:


Quote:
[jonesc@rhcsa03r5v ~]$ sudo su - oracle
[sudo] password for jonesc:
Sorry, user jonesc is not allowed to execute '/bin/su - oracle' as root on rhcsa03r5v.lamar.edu.
I've been researching this for days now and still having issues. Anybody got any ideas about what I'm missing here? I'm sure I have misconfigured, just can't see the error.

Last edited by jim mcnamara; 02-03-2015 at 02:54 PM..
 

10 More Discussions You Might Find Interesting

1. Linux

sudo, root password

Hi all.. I'm secering a RH 2.1 server, with gnome (not my choice...), as X manager. Is ther anyway to get sudo ask for root password other then the actual user's password? Like when you launch the graphical IHM to create a new user, it asks for root's password? Is there a way to do the same... (5 Replies)
Discussion started by: penguin-friend
5 Replies

2. UNIX for Dummies Questions & Answers

Possible to give non root user sudo to "crontab -l"

Does anyone know if this is possible? I want to give some users access to root's crontab but only with a read privilege. Is this possible to do or can only root or people with full root sudo view root's cron? (4 Replies)
Discussion started by: LordJezoX
4 Replies

3. AIX

sudo must be setuid root.

Guy's I'm trying to add some lines in sudo by useing this command visudo # User privilege specification root ALL=(ALL) ALL # Uncomment to allow people in group wheel to run all commands # %wheel ALL=(ALL) ALL # Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL #... (5 Replies)
Discussion started by: ITHelper
5 Replies

4. Shell Programming and Scripting

Cron job initiating ssh AND sudo (from user, not root)

I've been bashing my head on the desk for 2 days trying to get this to work, but I've had no luck. I'll try to be as clear as possible in my explanation without dragging out the details. I'm trying to set up a cron job for user "john" which runs a script. This script initiates an ssh connection to... (5 Replies)
Discussion started by: eh3civic
5 Replies

5. UNIX for Dummies Questions & Answers

sudo/root access

I'm actually working with a Ubuntu-System here and have a question about executing a command with 'sudo'. I tried and got a error message like "not allowed". After this I logged in with 'sudo -s' and typed the command without 'sudo'. This worked well. Can please somebody explain me this... (0 Replies)
Discussion started by: daWonderer
0 Replies

6. UNIX for Dummies Questions & Answers

Sudo to delegate permission from non-root user to another non-root user

I've been through many threads before i decide to create a separate thread. I can't really find the solution to my (simple) problem. Here's what I'm trying to achieve: As "canar" user I want to run a command, let's say "/opt/ocaml/bin/ocaml" as "duck" user. The only to achieve this is to... (1 Reply)
Discussion started by: canar
1 Replies

7. UNIX for Dummies Questions & Answers

sudo on becoming root

Anyone able to explain why if i run "sudo -i" or "sudo -s" i am able to get into root by just keying my own password? How to avoid this from happening coz i need all the users to use su - only. (2 Replies)
Discussion started by: timmywong
2 Replies

8. UNIX for Dummies Questions & Answers

Create user with sudo ability to root.

Hi All, I need to give an user sudo ability to root. We have also generated RSA key but unable to proceed further. For example after a user logs into the server normally and when he executes below command $ssh root@server_name This should take you to root prompt # Please help me.... (3 Replies)
Discussion started by: Rockyc3400
3 Replies

9. Solaris

Sudo access of rm to non-root user

Hello, It is Solaris-10. There is a file as /opt/vpp/dom1.2/pdd/today_23. It is always generated by root, so owned by root only. This file has to be deleted as part of application restart always and that is done by app_user and SA is always involved to do rm on that file. Is it possible to give... (9 Replies)
Discussion started by: solaris_1977
9 Replies

10. UNIX for Beginners Questions & Answers

Sudo to root, but keep my own aliases?

I have a coworker that has set up some funky aliases in /etc/bash.alias, and he insists on leaving them that way. For example he aliased "ll" to "ls -lahtr", which really bugs me. Anyway, I was wondering if there were a way for me to sudo to root without reading /etc/bash.alias, or maybe have... (6 Replies)
Discussion started by: paqman
6 Replies
NPRINT(1)							      nprint								 NPRINT(1)

NAME
nprint - NetWare print client SYNOPSIS
nprint [ -S server ] [ -h ] [ -U username | -n ] [ -C ] [ -q queuename ] [ -d job-description ] [ -p pathname-in-banner ] [ -B username-in- banner ] [ -s ] [ -f filename-in-banner ] [ -l lines ] [ -r rows ] [ -c copies ] [ -t tab size ] [ -T ] [ -N ] [ -F form-number ] filename DESCRIPTION
With nprint, you can print files on print queues of a NetWare file server. There are a lot of options, so you should probably wrap some default configurations into some shell scripts. nprint looks up the file $HOME/.nwclient to find a file server, a user name and possibly a password. See nwclient(5) for more information. Please note that the access permissions of .nwclient MUST be 600, for security reasons. OPTIONS
filename filename is the name of the file you want to print. If file is '-', or no filename is given, standard input is used. -h -h is used to print out a short help text. -S server server is the name of the server you want to use. -U username username is the user name to use for the print request at the server. -P password password is the password to use for the print request at the server. If neither -n nor -P are given, and the user has no open connec- tion to the server, nprint prompts for a password. -n -n should be given if no password is required for the print request. -C By default, passwords are converted to uppercase before they are sent to the server, because most servers require this. You can turn off this conversion by -C. -q queuename queuename is the name of the print queue to use at the print server. At present, you must specify it in upper case characters. -d job-description job-description is the string that appears in pconsole when you list the jobs for the print queue. It will also appear in the "Descrip- tion" field on the banner page. -p pathname-in-banner pathname-in-banner is the string (up to 79 characters) you want to be printed in the "Directory" field on the banner page. -B username-in-banner username-in-banner is the string (up to 12 characters) you want to appear on the lower part of the banner page. It will also appear in the "User name" field. -s Supress printing of banner page -f filename-in-banner filename-in-banner is the string (up to 12 characters) you want to appear in large letters on the lower part of the banner page. Default: the name of the file that is printed, or 'stdin'. -l lines lines is the number of lines to put on one page. Default: 66. -r rows rows is the number of rows to put on one page. Default: 80. -c copies copies tells the print server to the specified number of copies. Default: 1. -t tabs tabs is the number of spaces to print for a Tab-Character. Default: 8. -T tells the print server to expand Tab-Character and use 8 spaces -N tells the print server not to use Form Feeds -F form-number form-number is the the number of the form to be put into the printer. If it's different from the one currently in the printer, your job is only printed if a printer operator has put in the correct form. NOTES
The '-B' option was formerly '-b'. But it conflicted with 'bindery only' login option. SEE ALSO
nwclient(5), slist(1), pqlist(1), ncpmount(8), ncpumount(8) CREDITS
nprint was written by Volker Lendecke (lendecke@math.uni-goettingen.de) nprint 12/27/1995 NPRINT(1)
All times are GMT -4. The time now is 08:59 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy