UNIX for Advanced & Expert Users

Hi Unix experts. I got a quite complex sudoers scenario that I want to acheive. Hope someone could help.

Here's the setup:

3 linux servers: "server1", "server2" and "server3".
3 users: "user1", "user2" and "user3"
3 services running on 3 servers: "apache", "squid" and "sendmail"

Now here's what I want to achieve:

I want the 3 users to switch user to "apache_admin", "squid_admin" and "sendmail_admin".

The switch user is only allowed to the 3 linux servers. the sudoers file is being distributed to all servers and those servers is not listed above.

once the user successfully switch user to apache_admin" or "squid_admin" or "sendmail_admin, then he can restart the apache start/stop script or squid start/stop script and sendmail.

anyone got a good approach to archive this?

thanks a lot.

This may help point you in the right direction:

Code:

Create a group for these users and add them to it:
i.e.
wwwadmins = user1,user2,user3

In the /etc/sudoers file add the following entries.

Give the group permissions to run commands as specific users (using apache
as an example):

Require Password
%wwwadmins ALL=(apache_admin) /usr/sbin/apachectl

Password-less
%wwwadmins ALL=(www_admin) NOPASSWD: /usr/sbin/apachectl

Save the file. 

To verify run:

sudo -l
User user1 may run the following commands on this host:
    (apache_admin) /usr/sbin/apachectl

Then to run the command:

sudo -u apache_admin /usr/sbin/apachectl

Hope this helps.

Hi in2nix4life, thanks a lot for the very good example on how to achieve my goal.

I have few question that I would like to ask, would it be possible if I don't create a group but instead use the User_Alias and add users into it?

I also want the users to only execute the command in 3 servers. I do have 20 servers at all and the sudoers file is being distributed to all. How would I achieve that? would it be possible to use Host_Alias?

Would this work?

Code:

User_Alias WWWADMINS = user1, user2, user3
Host_Alias SERVERS = server1, server2, server3

WWWADMINS SERVERS=(apache_admin) /usr/sbin/apachectl
WWWADMINS SERVERS=(apache_admin) NOPASSWD: /usr/sbin/apachectl