HP-UX

Hello All,

I work as a system admin at a company of about 600 users on a HP-UX server. We have an IT department of about 15. My problem is that we give out the root password to the majority of them, they are phone support techs, as they need to get in to kill processes and setup users and printers on a daily basis.

Recently someone changed the root password and disabled the account and we couldn't find out who. After about 3 hours we found out our VAR was prompted to change it when they logged in but they were a little slow in letting us know.

This still ticked me off enough to want to lock down root as much as possible and to take away the privilege from as many people as I can starting with our tech support guys.

So, I was wondering if it's possible to create a new user (or possibly add to their current user account) that would have ONLY the following abilities:

- Kill user processes
- Setup new users
- possibly start a few random scripts

Any help would be greatly appreciated.

Mike

Well thats exactly the purpose of sudo...
Of course you could also give restricted SAM for user/printer administration and configure sudo for the rest...

OK, I've never used sudo before. I'll look into that.

About restricted SAM, where is the configuration for that?

For sudo, go to your favorite HP-Porting-Archive-center and download the latest.
As for restricted sam, its you, as root, by typing sam -r call the routine: you choos the user account first, then choose the privilidges you grant that user... Dont forget to save when leaving, to be sure, test after ( start by yourself! It can be handy)

You can check out more here: Hewlett-Packard Co.

Role based access control is supported by HP and is pretty slick. I use sudo on linux and osx, but found RBAC to be a much better product. The latest version includes a wrapper shell (privsh) that allows users to run authorized commands like they would logged in as root. RBAC uses audit logs and is very configurable. Definitely worth a look. Not sure if it is supported on 11.11 and older versions...