Sponsored Content
Top Forums Shell Programming and Scripting SUDOERS file settings Incorrect Post 303002759 by mohtashims on Thursday 31st of August 2017 04:56:30 PM
Old 08-31-2017
RedHat SUDOERS file settings Incorrect

1. I have user temp1 belonging to techx group
Code:
$ id
uid=1006(temp1) gid=1002(techx) groups=1002(techx)

2. We have user tomcat belonging to webadm group
Code:
$ id
uid=1017(tomcat) gid=1001(webadm) groups=1001(webadm)

3. We have user root belonging to root group.
Code:
$  id
uid=0(root) gid=0(root) groups=0(root)

My requirement is temp1 user should be able to sudo to any user belonging to webadm group and then from webadm group to sudo to root i.e temp1 -> tomcat -> root

I made the below changes in bold to the sudoers file using visudo to fulfill the above requirement.

Code:
## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL
%techx ALL=(ALL:webadm)     ALL

Code:
## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL
%webadm  ALL=(ALL:root)       NOPASSWD: ALL

But for some strange reason temp1 is able to directly sudo to root bypassing webadm group's user as u can see below.

Code:
[temp1@development_techx ~]$ sudo -u root -s -H
[sudo] password for temp1:
[root@development_techx temp1]# id
uid=0(root) gid=0(root) groups=0(root)

Can you please point out what is incorrect with my sudoers file above becoz of which it cant enforce users to techx to sudo to users of webadm and then eventually to root group ?

Last edited by rbatte1; 09-05-2017 at 10:18 AM.. Reason: Code tags
 

9 More Discussions You Might Find Interesting

1. Linux

sudoers file

Hi, I have edited 'sudoers' file to allow 'cads' user shutdown the system without providing a password. Can someone tell me what's wrong with my file? It's not working when I 'sudo SHUTDOWN' command: sudo: SHUTDOWN: command not found Thanks a lot! # Host alias specification... (4 Replies)
Discussion started by: whatisthis
4 Replies

2. UNIX for Advanced & Expert Users

Parsing Sudoers File

Does anyone know of a utility that can parse through a sudoers file and create an "expansion" dump of all users defined in the User Specification, outputting user, host, and command based on all defined Aliases? (3 Replies)
Discussion started by: jasondavey
3 Replies

3. UNIX for Dummies Questions & Answers

sudoers file questions

What is the difference between ALL and localhost in the bellow? # %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom # %users localhost=/sbin/shutdown -h now Thank you. (2 Replies)
Discussion started by: hemangjani
2 Replies

4. Solaris

sudoers file not found

root@dervish # cat /etc/sudoers cat: cannot open /etc/sudoers This is what I get when I try to search for the sudoers files. I want to create a user by name jda and assign him root privileges. How can I do that using sudo command and editing sudoers file. Please help me. (12 Replies)
Discussion started by: bharu_sri
12 Replies

5. UNIX for Advanced & Expert Users

sudoers file

i have defined a rule in the sudoers file so a specific user is able to run some commands as sudo with no password. my question is: is it possible to restrict a user to run commands as sudo only in a certain directory? for example: chown only the files that are located in /var/tmp. Thank you. ... (2 Replies)
Discussion started by: noam128
2 Replies

6. Shell Programming and Scripting

Scripting help with Sudoers file

Hello, Recently our team noticed access to groups had not been revoked per sudo file. We currently have around 160 AIX LPARS. I am hoping someone can help me write a script that would copy all sudoers file at each machine and dump into 1 large file for me to review. I have public... (1 Reply)
Discussion started by: audis$
1 Replies

7. UNIX for Dummies Questions & Answers

Help with Sudoers file

Hi using Solaris 10. trying to update /etc/sudoers file I need to add all the fist level operation team. This is what I have but it doesn't seem to work. Please help.Error message sudo su - >>> sudoers file: parse error, line 9 <<< >>> sudoers file: parse error, line 9 <<< ... (2 Replies)
Discussion started by: samnyc
2 Replies

8. Solaris

Sudoers file

In the sudoers file in Solaris... I am trying to limit the DEVELOPER user privileges to where those users can only use the “rm” command in certain directories. This is to prevent them from deleting directories or files and destroying a server. I want them to be able to use the "rm" command but... (1 Reply)
Discussion started by: nzonefx
1 Replies

9. UNIX for Beginners Questions & Answers

How to setup sudoers file ?

Hi, I have several employees of whom we have created Linux user ids as below. fred mohtashim jhon matt croft .... $ id uid=1018(jhon) gid=1003(techx) groups=1003(techx) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Note: All my employee users belong to techx... (3 Replies)
Discussion started by: mohtashims
3 Replies
LIBXO(3)						   BSD Library Functions Manual 						  LIBXO(3)

NAME
xo_emit -- emit formatted output based on format string and arguments LIBRARY
library ``libxo'' SYNOPSIS
#include <libxo/xo.h> LIBXO(3) BSD Library Functions Manual LIBXO(3) NAME
xo_open_list xo_open_list_h xo_open_list_hd xo_open_list_d xo_open_instance xo_open_instance_h xo_open_instance_hd xo_open_instance_d xo_close_instance xo_close_instance_h xo_close_instance_hd xo_close_instance_d xo_close_list xo_close_list_h xo_close_list_hd xo_close_list_d -- open and close lists and instances LIBRARY
library ``libxo'' SYNOPSIS
int xo_open_list_h(xo_handle_t *xop, const char *name); int xo_open_list(const char *name); int xo_open_list_hd(xo_handle_t *xop, const char *name); int xo_open_list_d(const char *name); int xo_open_instance_h(xo_handle_t *xop, const char *name); int xo_open_instance(const char *name); int xo_open_instance_hd(xo_handle_t *xop, const char *name); int xo_open_instance_d(const char *name); int xo_close_instance_h(xo_handle_t *xop, const char *name); int xo_close_instance(const char *name); int xo_close_instance_hd(xo_handle_t *xop); int xo_close_instance_d(void); int xo_close_list_h(xo_handle_t *xop, const char *name); int xo_close_list(const char *name); int xo_close_list_hd(xo_handle_t *xop); int xo_close_list_d(void); DESCRIPTION
Lists are sequences of instances of homogeneous data objects. Two distinct levels of calls are needed to represent them in our output styles. Calls must be made to open and close a list, and for each instance of data in that list, calls must be make to open and close that instance. The name given to all calls must be identical, and it is strongly suggested that the name be singular, not plural, as a matter of style and usage expectations. A list is a set of one or more instances that appear under the same parent. The instances contain details about a specific object. One can think of instances as objects or records. A call is needed to open and close the list, while a distinct call is needed to open and close each instance of the list: xo_open_list("item"); for (ip = list; ip->i_title; ip++) { xo_open_instance("item"); xo_emit("{L:Item} '{:name/%s}':0, ip->i_title); xo_close_instance("item"); } xo_close_list("item"); Getting the list and instance calls correct is critical to the proper generation of XML and JSON data. EXAMPLE: xo_open_list("user"); for (i = 0; i < num_users; i++) { xo_open_instance("user"); xo_emit("{k:name}:{:uid/%u}:{:gid/%u}:{:home}0, pw[i].pw_name, pw[i].pw_uid, pw[i].pw_gid, pw[i].pw_dir); xo_close_instance("user"); } xo_close_list("user"); TEXT: phil:1001:1001:/home/phil pallavi:1002:1002:/home/pallavi XML: <user> <name>phil</name> <uid>1001</uid> <gid>1001</gid> <home>/home/phil</home> </user> <user> <name>pallavi</name> <uid>1002</uid> <gid>1002</gid> <home>/home/pallavi</home> </user> JSON: user: [ { "name": "phil", "uid": 1001, "gid": 1001, "home": "/home/phil", }, { "name": "pallavi", "uid": 1002, "gid": 1002, "home": "/home/pallavi", } ] LEAF LISTS
In contrast to a list of instances, a "leaf list" is list of simple values. To emit a leaf list, call the xo_emit() function using the ""l"" modifier: for (ip = list; ip->i_title; ip++) { xo_emit("{Lwc:Item}{l:item}0, ip->i_title); } The name of the field must match the name of the leaf list. In JSON, leaf lists are rendered as arrays of values. In XML, they are rendered as multiple leaf elements. JSON: "item": "hammer", "nail" XML: <item>hammer</item> <item>nail</item> ADDITIONAL DOCUMENTATION
Complete documentation can be found on github: http://juniper.github.io/libxo/libxo-manual.html libxo lives on github as: https://github.com/Juniper/libxo The latest release of libxo is available at: https://github.com/Juniper/libxo/releases SEE ALSO
xo_emit(3) HISTORY
The libxo library was added in FreeBSD 11.0. AUTHOR
Phil Shafer BSD
December 4, 2014 BSD
All times are GMT -4. The time now is 09:58 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy