hi everyone.
iīve been burning my head for a week now with this problem and i couldnīt find a solution. iīve been looking for an answer in this forum but nothing either. so i decided to ask.
the thing is, i want to create a users with permission to kill just a group of users. i know how to write the script and everything, but my problem is that that user has no permission to kill other users. i understand that only a user with UID=0 can kill another user. i dont want to grant this particular user with root privileges, since that would be stupid.
the "sudo" could help me, but its not installed on my server. can anyone find another way to do it?
im working on a "SunOS 5.9 Generic_118558-10 sun4u sparc SUNW,Sun-Fire-V440"
Download sudo from sunfreeware.com - that is the best tool for this IMHO. You could probably do a similar thing with RBAC, but sudo would be easier for this.
hi. thanks for answering. i leave that option to the last, since probably my boss wont like it.
could anyone think of another way around it?
thanks again.
Create a script owned by root and with the suid bit on it.
That way any used that can access the script is temporary granted root privileges.
However within that script you need to do a lot of checking to make sure that that it records who requested to kill a program/script of another user, and that the program/script requested to be killed is owned by a user who's programs/scripts can be killed by the requesting user.
Option 2:
Create a script which only stores requests into a file.
Additionally create a "root" cron job which reads the file with requests.
Again you will have to do a lot of checking if the requestor is allowed to kill those programs/scripts.
But, if I would be your boss, I would be even less happy about either of these 2 implementations. It opens all kind of possibilities for users to gain root access to your system. So you need to know exactly what you are doing.
Most systems don't honor setuid/setgid on scripts. My Linux system at home doesn't, and I don't believe HP-UX or AIX do either.
However, Solaris does honor setuid scripts. A setuid script will open an unclosable security hole on most systems. Solaris has the fd file system and uses it to close that particular hole.
I too think that sudo is right way to go here; so I have been reluctant to mention another option. But now that I'm here... Let's say that we have three users whose processes need to be killed:
moe (uid=1025)
larry (uid=1026)
curly (uid=1027)
And we want shemp (uid=1028) to be able to kill processes owned only by moe, larry, and curly. We create a group called "killers" with a gid of, say, 1500; and we make shemp a member of that group. Now, we
Now /usr/local/killcmds has a private kill command for each killable user. It is setuid to the target and it can be executed only by members of the killers group. These kill commands are enough, but I would also develop a script as a front end that invokes the correct kill command. I have not tested this, but I believe that it will work.
well guys, what can i say? thanks a lot to everyone... you gave me a lot of tools to work with.... now, when i have the time, ill get into it, to see what comes out, and i let you all know.
probably the easiest way is to use sudo, but what my boss wont like is the fact that i downloaded something from the outside of our network... i dont know how can i put it for you guys to understand how short his mind is... but that doesnt have anything to do with this forum...
i thank you all again
Hi All,
We have a scenario in production where we want only one user from a group to modify the file. The file is not set to write permission for application manager.
-r--r--r-- 1 amgr u00 15661716 Aug 30 00:06 DCI.dat
So here amgr will have permission to edit the file. We want a... (10 Replies)
Hi folks,
I am trying to grant the access like below items using the setfacl command, but i couldn't achieve as what I required. any other possibility.
username : testing
Readonly access in /form_dl/system/prd/logs
Write only access in /form_dl/system/prd/deploy
No access to other... (0 Replies)
Hi,
I'm newbie to unix.
There is a directory, say Testing/ under /home/user1.
I have created a user by the name check.
I was looking for a way to give the above user read & execute access only to this directory Testing/ while for other remaining files,directories,etc this user... (2 Replies)
I have a script that do read data for Munin Graph.
My problem is that it have some reading problems, and I do not know how to fix it.
script traf.sh (its not the complete script)#!/bin/sh
PORT="80"
NETDEVICE="eth0"
IPTRAFlogdir="/var/log/iptraf"
... (8 Replies)
I have problem giving user access to his public_html directory.
While when I am logged as root I can access my files by going to
www.myserver.com/file.htmlwhere file.html is actually on this path...
var/www/file.htmlBut when user tries to access his file.html on this path....
~user/file.html it... (10 Replies)
Is there any possible way to give permission to a user to a file whose not a member of that group. Also the permission of the file shouls be given only to that USER but not all OTHERS.
Thanks in Advance for ur replies/suggestions... (5 Replies)
Hi all,
I created testuser. by following command.
/usr/sbin/adduser -n test -d /disk05/collections/GET/testdata/
and then set its password by following command.
passwd testuser
When I login to system by testuser, it enters everything is ok.
The problem is how to set permission to this... (3 Replies)
I have some of programs in unix system which are to started with one_user say "xxxx".
I have sudo permission if i start these programs with sudo it shows root permission. But i want these programs permession should be "xxxx".
I tried "su user_name -c Program_name"
but it is not... (3 Replies)
Hi All,
How can i give permission for a specific user ( eg. admin ) ?
I tried with chmod admin+r prog.sh
which doesnt work.
Is there any way i can specify a user's name and give the permission?
Thanks in advance.
Saneesh Joseph. (1 Reply)