UNIX for Dummies Questions & Answers

Hi,

I was asked to create sudoers file for operation team so they can sudo as another user and run few commands.

I have updated /etc/sudoers file.

Code:

 
User_Alias LEVEL1 = JamesF, dennisW, juanC, steveS,
 
Cmnd_Alias SU_PROD=/bin/su prod, /bin/su - prod
Cmnd_Alias SU_NYOP=/bin/su nyop, /bin/su - nyop
Cmnd_Alias SU_NEWSPROD=/bin/su newsprod, /bin/su - newsprod

LEVEL1 ALL= SU_PROD
LEVEL1 ALL= SU_NYOP
LEVEL1 ALL= SU_NEWSPROD

when I run the command, I get this error message.

Code:

 
sudo prod /bin/su prod
[No Valid Runas is Matched]
sudo: prod:command not found.
Check the path or specify path plus command.

Try:

Code:

sudo /bin/su - prod

This is because you didn't tell sudo as which user-ID the command should run. sudo is about allowing a (group of) user(s) to run a certain (group of) command(s) not under the own ID but another. You defined, which command(s) that should be:

Code:

Cmnd_Alias SU_PROD=/bin/su prod, /bin/su - prod

and which user(s) should be allowed to do that:

Code:

User_Alias LEVEL1 = JamesF, dennisW, juanC, steveS,

but here:

Code:

LEVEL1 ALL= SU_PROD

you missed to tell as which user-ID they should be allowed to do that. Obviously they are allowed to do this on their own anyway, because every user can issue a

Code:

su - otheruser

yes? So it seems that sudo is of little value, but that all changes when we issue the command as user "root". The kick is that user "root" - unlike other users - is not asked for a password when using su and this is what one usually wants to exploit: the ability to change to a user based on belonging to a certain group of users (who are allowed to do that), rather than because of knowing a certain password.

See the man page of sudo which contains a lot of examples and modify your configuration accordingly.

I hope this helps.

bakunin