UNIX for Advanced & Expert Users

A handful of the easiest ways cha can still add users on your system:

Code:

# Make a shell do it
sudo sh -c 'useradd'

# Put it in a script and run it
echo 'useradd' > nicetry.sh ; chmod +x nicetry.sh ; sudo $PWD/nicetry.sh

# Put it in a script and make a shell do it
echo 'useradd' > nicetry.sh ; sudo bash $PWD/nicetry.sh

# Duplicate the command to something sudoers hasn't blocked
sudo ln /usr/sbin/useradd /usr/sbin/nicetry ; sudo nicetry

# Install something else
sudo apt-get install alternate-utility ; sudo alternate-utility

# manually edit password files
sudo vi /etc/passwd ; sudo vi /etc/shadow

# edit sudoers to give yourself permissions
sudo visudo

# mount other folder on top of /etc.  Even an unwritable filesystem won't stop this one!
sudo mount --bind /fake-etc /etc

Your screen door is leaking. You blocked one pinhole. There's 10,000 more for you to find and plug individually.

Hi Bakunin,

Thanks for the detailed information.

Your response helped me lot to gain knowledge on this topic/issue

Yes you are right, there are other ways as well to undo the changes i have done and to add and delete user.
I have informed the same to customer and told that we can't limit the user until he has all the rights.

If you carefully re-read the posts above you will see that Corona688 already adressed that: instead of giving a user all rights (in fact that means he can become the root user, which is allowed to do everything) and then (try to) take away the rights you don't want him to have you should look at it differently from the start:

What does the user have to do and precisely which rights does he need for that?

Once you answered this question (not to me - to yourself) you can start thinking about ways to give the user exactly these rights - and nothing more. Instead of giving out all rights and then taking back some you only give out what is absolutely necessary in the first place.

If you tell us about your (long-term) goals - that is, what is the user account supposed to do - we can help you come up with ways to achieve that. It is perhaps possible to do it but just not in the way you tried.

I hope this helps.

bakunin

I know this might be a daft question, but why would you want to share a very powerful account with someone else but leave one thing out. Either you trust them, or you don't. Don't give privileges to anyone for anything unless you are happy that they are safe to do the thing and that they can't escape and do something else.

I might be paranoid, but not only did we keep all users as 'ordinary' and with (full path) scripted sudo rules but for things with user accounts (even password resets) we intercepted the official code and added our own logging. People in the security group which are already allowed to do such things ended up being logged so we could at least trace it back. You learn to be paranoid in a financial company where someone managed to get another user's password rest and then performed fraudulent actions (i.e. I've seen the death certificate, pay out the life assurance) as someone else.


Basically, only give the minimum required to do the job. Don't just allow them in with total access if they don't need it or because it's convenient and saves having to define appropriate security rules on your data.

Security is usually like birth control methods - people don't like them and try to avoid using them but if you get caught out, it is too late. Prevention (or abstinence) is better than remedial action or just living with the consequences.

You need to ask yourself very carefully what they actually need. Be extremely cautious.


Just my thoughts.


Can you tell us more about what they really need to do?

Robin