|
|
Sponsored Content
The Lounge
What is on Your Mind?
Root User Management
Post 95760 by mr_manny on Saturday 14th of January 2006 12:08:24 PM
01-14-2006
root can only access any box through it's console, and only the SA team has root.
Each of our boxes have there own PWD, kinda reassures you on which box our on
All passwords expire, except for root...which I feel we don't change often enough.
Our shop is a big advocate of sudo.
We have captured menus (that utilize sudo) in place on ALL systems for Datactr personnel for the following actions:
Create unix accounts (IS and User)
Change passwords (all except for root)
Deactivate IS and remove User accounts.
As mentioned before, all of these activities will leave an audit trail...and In our case they will also have an associated HelpDesk request #.
Remember when you had to do all of these tasks...sudo is your friend
We also utilize email (end-of-day) to help us manage other Audit policies, like the following:
invalid attempts at sudo (not valid sudo user)
invalid attempts at su (not part of SA team)
invalid login attempts 3 or >...these are Hourly.
(This is just an example of what can implemented, this list can go on-and-on)
got SOX?
In todays SOX climate, I find that all of these policies and associated audit trails are necessary.
If you don't have something similar in place, you may want thinking about how some of them could provide some benefit to your env..
Each of our boxes have there own PWD, kinda reassures you on which box our on
All passwords expire, except for root...which I feel we don't change often enough.
Our shop is a big advocate of sudo.
We have captured menus (that utilize sudo) in place on ALL systems for Datactr personnel for the following actions:
Create unix accounts (IS and User)
Change passwords (all except for root)
Deactivate IS and remove User accounts.
As mentioned before, all of these activities will leave an audit trail...and In our case they will also have an associated HelpDesk request #.
Remember when you had to do all of these tasks...sudo is your friend
We also utilize email (end-of-day) to help us manage other Audit policies, like the following:
invalid attempts at sudo (not valid sudo user)
invalid attempts at su (not part of SA team)
invalid login attempts 3 or >...these are Hourly.
(This is just an example of what can implemented, this list can go on-and-on)
got SOX?
In todays SOX climate, I find that all of these policies and associated audit trails are necessary.
If you don't have something similar in place, you may want thinking about how some of them could provide some benefit to your env..
|
|
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hi all,
I am using Sun Solaris 9 .In this system normal users unable to create files from the command line.I added these users in bin,adm and even root group i found them unable to create a file. (1 Reply)
Discussion started by: mallesh
1 Replies
2. Shell Programming and Scripting
Hi All
I have written one shell script for GPRS route add is given below named GPRSRouteSet.sh
URL="www.google.com"
VBURL="10.5.2.211"
echo "Setting route for $URL for GPRS"
URL_Address=`nslookup $URL|grep Address:|grep -v "#"|awk -F " " '{print $2}'|head -1`
echo "Executing ... (3 Replies)
Discussion started by: mnmonu
3 Replies
3. UNIX for Dummies Questions & Answers
hi
i am new to unix and i have abig task. i have to \run particular commands having root privileges from a non root user. i know sudo is one of the way but i need sum other approach kindly help
Thanks (5 Replies)
Discussion started by: suryashikha
5 Replies
4. Solaris
:confused: I installed latest version of java ( jre 1.6) on Solaris Machine ......when I run java -version as root, shows the latest version but when I run java -version as normal user, shows the old / previous version
What should I do to fix this ...should show the latest version... (3 Replies)
Discussion started by: frintocf
3 Replies
5. UNIX for Dummies Questions & Answers
I've been through many threads before i decide to create a separate thread.
I can't really find the solution to my (simple) problem.
Here's what I'm trying to achieve:
As "canar" user I want to run a command, let's say "/opt/ocaml/bin/ocaml" as "duck" user.
The only to achieve this is to... (1 Reply)
Discussion started by: canar
1 Replies
6. Shell Programming and Scripting
Hi Every body,
I would need a shell script program to login as different user and perform some copy commands in the script.
example: Supppose ora_toms is the active user
ora_toms should be able to run a script where user: ftptomsp pass: XXX should login through and run the commands
... (9 Replies)
Discussion started by: ujjwal27
9 Replies
7. UNIX for Advanced & Expert Users
Hi!! one strange problem occurred with my RHEL 5 box.
i'm having logs folder with ownership of non-root user. Created some files with root user under logs folder.
here is the scene:
-rw-r----- 1 root root 1048227 Feb 28 12:34 SystemOut_13.02.28_12.34.10.log
-rw-r----- 1 root root ... (6 Replies)
Discussion started by: sukhdip
6 Replies
8. Shell Programming and Scripting
Currently in my system Red Hat is installed. And Many user connect to my machine via SSH Techia Terminal.
I want to give some users a root level access.
Can anyone please help me how to make it possible. I too searched on the Google but didn't find the correct way
Regards
ADI (4 Replies)
Discussion started by: adisky123
4 Replies
9. UNIX for Dummies Questions & Answers
Whenever i switch from root to another user, by doing su - user, it takes me to home directory of user. This is very annoying as i want to be in same dir to run different commands as root sometimes and sometimes as normal user.
How to fix this? (1 Reply)
Discussion started by: syncmaster
1 Replies
10. Shell Programming and Scripting
Hi,
I need to switch from local user to root user in a shell script.
I need to make it automated so that it doesn't prompt for the root password.
I heard the su command will do that work but it prompt for the password.
and also can someone tell me whether su command spawns a new shell or... (1 Reply)
Discussion started by: Little
1 Replies
LEARN ABOUT DEBIAN
csp_helper
csp_helper(1) USER COMMANDS csp_helper(1) NAME csp_helper - A collection of caspar helper scripts SYNOPSIS csp_install dir (directory) file (file) csp_mkdircp dir (directory) file (file) csp_scp_keep_mode h ([user@]host) dir (directory) file (file) csp_sucp h ([user@]host) dir (directory) file (file) DESCRIPTION The scripts csp_install, csp_mkdircp, csp_scp_keep_mode and csp_sucp are helpers for caspar(7). These scripts typically are not invoked directly, but via a Makefile which uses caspar. See the notes on csp_PUSH in caspar(7) for information on how to link csp_install, csp_scp_keep_mode and csp_sucp to caspar. install DESCRIPTION csp_install creates the required directory (if needed) and installs the file, preserving timestamps. It uses install(1). install EXAMPLES csp_INSTALL_OPTIONS='--owner=www-data --group=www-data' csp_INSTALL_MODE=ugo=r csp_install /srv/www index.html csp_INSTALL_MODE=u=rwx,go= csp_install /usr/local/sbin mkpasswd install ENVIRONMENT csp_install honors csp_INSTALL_OPTIONS and csp_INSTALL_MODE (default is u=rw,go=r). mkdircp DESCRIPTION csp_mkdircp calls mkdir(1) and cp(1). scp_keep_mode DESCRIPTION csp_scp_keep_mode uses ssh to copy a file to a remote host, keeping its file permission mode. The trick used is a combination of mktemp(1) and mv(1). Useful if you'd like to be sure a file gets installed e.g. group writable, without fiddling with permission bits on the remote host. scp_keep_mode EXAMPLE chmod g+w rc csp_scp_keep_mode root@gandalf /etc/uruk rc scp_keep_mode ENVIRONMENT csp_scp_keep_mode honors csp_SSH ("ssh" by default). sucp DESCRIPTION csp_sucp calls cat(1) from within sudo(1) from within ssh(1). This allows one to copy files to accounts on hosts one can only reach by call- ing sudo on the ssh-reachable remote host. Typically, one wants to install a root-owned file, but one does not want to allow access to the root-account directly from ssh. Typically sudo is used as an extra line of defense. sucp EXAMPLES Some examples: csp_sucp rms@bilbo /etc fstab csp_sucp monty-python commit/ trailer.txt sucp BUGS If NOPASSWD is not set in the sudoers(5) file, and one's timestamp is expired, csp_sucp will forward the sudo password prompt. The given password will be echoed on the console! AUTHOR Joost van Baal-Ili SEE ALSO caspar(7) The caspar homepage is at http://mdcc.cx/caspar/ . csp_helper 20120514 14 mai 2012 csp_helper(1)