Sudo to other user

Thread Tools Search this Thread
Operating Systems AIX Sudo to other user
# 1  
Old 08-27-2013
[Solved] Sudo to other user

Hello All,
I am trying to grant sudo privileges to a set of users (say tom and jerry) to sudo to another set of users (jim, harry). This is because we don't want to disclose the password of jim and harry.

I did defined the user_alias and runas alias.
%wms ALL = (USR) /usr/bin/su -, where  wms is the group to which (tom and jerry belong) and USR is the Runas_Alias for jim and harry

But, it is not liking it. I did multiple combinations but it ain't working.

I am running it on AIX 7.1, thanks in advance.

I am able to do it successfully by adding the below, but I have 9 users so I don't want to add 9 lines in sudoers file.
JDA    ALL = /usr/bin/su - jim, where JDA is User_Alias for tom and jerry

Last edited by ibmtech; 08-27-2013 at 02:58 PM..
# 2  
Old 08-27-2013
What do you mean "to sudo to another set of users"? Are you confusing sudo with su? Also, you can stack the two commands, for example, if tom types "sudo su - jim" he will use sudo to execute the su command, and become the jim user, without knowing jim's password. Additionally, the NOPASSWD option in the sudoers file will allow tom to do this without typing any password at all.
# 3  
Old 08-28-2013
First, you have to create a command-alias: the command(s) you want to allow. Than you have to create a user-alias: the (group of) user(s) you want to make use of the allowed commands. Finally you have to create a rule, where you state that the users in user-alias are allowed to execute the commands in command-alias. (I skipped the host-alias as this seems to be no issue here.)

That is the general outline of what you have to do. Please post these three definitions from your file /etc/sudoers here, then we can evaluate what you have done and what went wrong.

I hope this helps.

# 4  
Old 08-28-2013
Alright here is what I did
User_Alias JDA = rlalgudi, kwalker, ndevries, afitzpat
Runas_Alias DA = wmstst, modtst, emstst, remtst

Also, I have tried using
%wms ALL = (DA) /usr/bin/su -, where wms is the group to which User_Alias users belong to

I want to achieve all this in one command, instead of specifying the access to each user. Like it is working if I do the below
%wms ALL = /usr/bin/su - wmstst

But when I try to use Runas_Alias instead of single user I get the below.
kwalker@myaixhost:/home/kwalker:$ sudo -l
User kwalker may run the following commands on this host:
    (wmstst, modtst, emstst, remtst) ALL
kwalker@myaixhost:/home/kwalker:$ sudo su - emstst
Sorry, user kwalker is not allowed to execute '/usr/bin/su - emstst' as root on myaixhost.

# 5  
Old 08-28-2013
If i am not mistaken you can include user groups in the User_Alias definition. If you have already a Unix group for this i suggest you use this instead of specifying another group in the sudoers file. This is easier to maintain.

If you want to switch to another user you have to use the "su" command as "root", sudos complaint was basically that you have no rule defining such a privilege for the users you want to be able to become other users. A "Runas_Alias" defines the (effective) user (ID) under which to run the command. You have allowed all users in JDA to run all commands as one of the users in DA - certainly not what you wanted. (To test my assumption: try "sudo -u emstst /bin/ls" as user "kwalker". This should work - you have run "/bin/ls" under the effective user ID of emstst.)

Delete the Runas_Alias. Define a Cmnd_Alias with the commands "su - wmstst", "su - modtst", etc., then allow the user "User_Alias-Name" to run command "Cmnd_Alias-Name" as root. This should work.

I hope this helps.

This User Gave Thanks to bakunin For This Post:
# 6  
Old 08-29-2013
It ain't working can you provide me the syntax?

---------- Post updated at 12:33 PM ---------- Previous update was at 12:11 PM ----------

Thanks Bakunin, that was it, I was able to achieve using

As you mentioned above.

This is what I did
User_Alias JDA = tom, julie, harry
Cmnd_Alias CMD = /usr/bin/su - wmstst,/usr/bin/su - emstst, /usr/bin/su - modtst
JDA ALL=CMD,   also I tried %groupname, which works fine too, but I rather go with User_Alias

Thanks a lot again!
This User Gave Thanks to ibmtech For This Post:
# 7  
Old 08-29-2013
I am glad it worked out for you. What you did was exactly what i had in mind.

Moderator's Comments:
Mod Comment Changed thread title to SOLVED.

This User Gave Thanks to bakunin For This Post:
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. AIX

What is the command to add user to sudo?

Hi guys, I would like to add a new user and add him to sudo. appreciated if someone can give me the command to do so. Thanks (3 Replies)
Discussion started by: leecopper
3 Replies

2. Shell Programming and Scripting

sudo su - user not working

Hi All, I need your expertise to solve my problem, my account has permission to make sudo and su but when I try to switch user in a shell, it does not work with following message: "Sorry, user jmbeltra is not allowed to execute '/usr/bin/su -c echo HELLO THERE - oracle' as root on dbbr1k01" I... (4 Replies)
Discussion started by: Axtel
4 Replies

3. UNIX for Dummies Questions & Answers

Sudo for Non-Admin User

Can a user who is not an admin be added to sudoers to allow them to elevate to root and run administrative tasks only from the command line by using sudo, but not be able to perform administrative tasks in any other capacity? ---------- Post updated at 11:07 AM ---------- Previous update was at... (1 Reply)
Discussion started by: glev2005
1 Replies

4. Linux

Linux- Useradd / sudo user

Hi, I am new in linux. Please help for create new user and also need to give sudo access in linux box. Please help me Now i am having new access Thanks, Mani (2 Replies)
Discussion started by: Mani_apr08
2 Replies

5. UNIX for Dummies Questions & Answers

sudo su - USER ??? How to??

Hi folks, Here is my question of the day 8-) I have to provide the ability to sudo su - orapd2 & sudo su - pd2adm for the following people User A, B, C, D which all of them are part of the group staff. orapd2 and pd2adm are also users. Users A, B, C, D should not type the password for... (2 Replies)
Discussion started by: 300zxmuro
2 Replies

6. UNIX for Dummies Questions & Answers

sudo user

I am trying to run a command from different user on my server. However when i execute the command it asks for password can you please help. when i use this command to switch user no password is required 1) sudo su - bilbtf42 when i use 2) sudo su - bilbtf42 cp file1 direcotry1/file1 ... (3 Replies)
Discussion started by: blackeyed
3 Replies

7. AIX

sudo user access

I have installed sudo on AIX 6100-04 and want to know how do I set it up for a user to be able to run only some commands? I want to give the user the rights to only cd to certain directories and run the ls command to name a few? Are there any issues with running sudo when the user is forced to... (2 Replies)
Discussion started by: daveisme
2 Replies

8. AIX

Run sudo to another user

Run sudo to another user . I have two users in my AIX system appadmin (Application admin ) and appuser (Application user) Application Admin user has special permission to run every thing about this application. I have one script called /usr/ Only appadmin has permission to run this... (11 Replies)
Discussion started by: Mr.AIX
11 Replies

9. Linux

Sudo user vs RBAC

Hi all, What the difference between the sudo users & RBAC when the talk of effects after doing the above comes??? any differences between them ,kindly list ?? (1 Reply)
Discussion started by: saurabh84g
1 Replies

10. UNIX for Dummies Questions & Answers

scp with a sudo user

Morning guys, I'm hoping you can advise me as to whether or not the following is possible. Is there a way of firing off an scp command with a sudo user as the user? e.g. I am logged onto server1 as smith, but want to pull files from server2 that I can only read as sudo jones. In my mind it... (3 Replies)
Discussion started by: dlam
3 Replies
Login or Register to Ask a Question