04-23-2019
Quote:
Originally Posted by
rbatte1
Okay, so it's DB2. I think that it is usual for all DB2 users to actually be OS users and you might just need to set up the trust there. You might need to use sudo to run the processes as the nominated OS user that can connect to the database and do the work.
Can you force that through? make sure your sudo rules only allow them to run a specific script as the trusted account that means they can only do what you want, not just a general "Connect me to the database and wheeeee....."
Also, do not allow them to get to the shell prompt as the trusted account else they can probably bypass any rules you want to define. Basically, don't trust them to do anything at all except a very controlled script.
If this is for end users, then you might need to set the sudo rules to use NOPASSWD to permit them without prompting for their own password all the time.
I hope that this helps,
Robin
Thanks Robin for sharing it. Sudo with nonpasswd is really good idea. To be honest I myself did 1 automation few backs only with using this and this facility is cool and safe too.
Thanks,
R. Singh
8 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
I'm finding the following command very tedious to type in all the time, so I created a one line bash script called mount.bash with the following contents:
mount -t cifs //mark/C\$ -o unc=//mark\\C$,ip=10.1.1.33,user=Administrator,password=$1 /mnt/mark
I don't like the fact that I have to put... (5 Replies)
Discussion started by: siegfried
5 Replies
2. Shell Programming and Scripting
Hi Unix experts....
I am in the process checking user and root password of more than 1000 servers manulay.
I am very pissed of checking these many servers manualy.
Could some one of you help me how can i check the passwords just by runing some scripts..!
Need Help Guys..! :confused: (5 Replies)
Discussion started by: bullz26
5 Replies
3. Solaris
Ok,
I am trying to install solaris, but I would like as a lean installation as possible (while still having a shread of functionality).
If I chose the minimal install I have little if no utilities to do work on the box.
My question is what installation method do most admins take?
... (7 Replies)
Discussion started by: liven
7 Replies
4. Shell Programming and Scripting
Hi
Most of the shell scripts I am dealing with have to connect to oracle database . The username password is stored in a environment file which sets the variables for username and password . Set user id do not work on AIX so users who will execute these scripts need to have read or execute... (5 Replies)
Discussion started by: clifford
5 Replies
5. Shell Programming and Scripting
Hi All ,
I need to call a script runscript_B.sh on server A, the runscript_B.sh script locating in server B.
The runscript_B.sh in calls another script runscript_A on server A itself.
it seend, i need to be connect from Server A to Server B using ssh.
I have tryed like this in... (3 Replies)
Discussion started by: koti_rama
3 Replies
6. UNIX for Advanced & Expert Users
I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the... (5 Replies)
Discussion started by: Anne Neville
5 Replies
7. AIX
Does anyone know when AIX started using /etc/security/passwd instead of /etc/passwd to store encrypted passwords? (1 Reply)
Discussion started by: Anne Neville
1 Replies
8. UNIX for Advanced & Expert Users
Hi,
this question is not specially unix related, but I expect advanced and expert unix users to have a solution for this, and I've found no other subforum that fits ;)
what do you use to store accounts, customer ids, ip addresses, users and specially passwords, to access them from... (6 Replies)
Discussion started by: funksen
6 Replies
LEARN ABOUT DEBIAN
0store-secure-add
0STORE-SECURE-ADD(1) 0STORE-SECURE-ADD(1)
NAME
0store-secure-add -- add an implementation to the system cache
SYNOPSIS
0store-secure-add DIGEST
DESCRIPTION
This command imports the current directory into the system-wide shared Zero Install cache, as /var/cache/0install.net/implementa-
tions/DIGEST. This allows a program downloaded by one user to be shared with other users.
The current directory must contain a file called '.manifest' listing all the files to be added (in the format required by DIGEST), and this
file must have the given digest. If not, the import is refused. Therefore, it is only possible to add a directory to the cache if its name
matches its contents.
It is intended that it be safe to grant untrusted users permission to call this command with elevated privileges. To set this up, see
below.
SETTING UP SHARING
To enable sharing, the system administrator should follow these steps:
Create a new system user to own the cache:
adduser --system zeroinst
Create the shared directory, owned by this new user:
mkdir /var/cache/0install.net
chown zeroinst /var/cache/0install.net
Use visudo(8) to add these lines to /etc/sudoers:
Defaults>zeroinst env_reset,always_set_home
ALL ALL=(zeroinst) NOPASSWD: /usr/bin/0store-secure-add
Create a script called 0store-secure-add-helper in PATH to call it. This script must be executable and contain these two lines:
#!/bin/sh
exec sudo -S -u zeroinst /usr/bin/0store-secure-add "$@" < /dev/null
The other Zero Install programs will call this helper script automatically.
FILES
/var/cache/0install.net/implementations
System-wide Zero Install cache.
LICENSE
Copyright (C) 2009 Thomas Leonard.
You may redistribute copies of this program under the terms of the GNU Lesser General Public License.
BUGS
This program is EXPERIMENTAL. It has not been audited. Do not use it yet in security-critial environments.
The env_reset line in sudoers may not be required. sudo(1) seems to do it automatically.
If sudo let us check whether we could call a command then we could switch to using it automatically, instead of needing to add the helper
script. Currently, sudo delays for one second and writes to auth.log if we try to use this system when it hasn't been set up.
Please report bugs to the developer mailing list:
http://0install.net/support.html
AUTHOR
Zero Install was created by Thomas Leonard.
SEE ALSO
0store(1)
The Zero Install web-site:
http://0install.net
Thomas Leonard 2010 0STORE-SECURE-ADD(1)