UNIX for Dummies Questions & Answers

I have been volunteered by my boss to be the sysadmin for our production redhat server. He asked me to tighten the security to avoid mishaps like "rm -f *" that occured not long ago.

Right now, we have 53 users sudo-ing into the machine and it is an audit nightmare. I am wondering if it possible to allow user access only on specific days of the week.

For example, can I have user 'Joe' allowed to login on Tuesdays and Thursdays ONLY and 'Jane' only on Sundays? Can "etc/sudoers" be customized to allow this?

Is there a better way instead of using sudoers?

53 people using sudo why not but 53 people sudo root??

Well a better way would be to know what for, and allow sudo to specific commands (we do that by groups, but sudoers file is pages after...)
Why do they need sudo?

That you have 53 users using sudo, is certainly far better than 53 users using root!

sudo does not appear to support this directly, but sudo uses pam, which does have time-based limits. I'm not quite sure how to apply them here however.

Why do they need sudo? Unknown...this was setup that way before I joined this team.

The majority of the users do create and mod ksh scripts which can affect database processes as well as data. Many mistakes were made which cause prod issues.

At least, the majority of users should not be able to use vi, cp, mv and rm.

Yes, this can be a good idea.

I suggest you write a cron script that copies sudoers files with different configurations.

For example you create an sudoers file that does not permit sudoers (if that is what you want) and then keep that file in place (but make a copy); then on "Monday" for example, copy your current sudoers file in place which permits sudoers.

Then when Monday is "over" then copy your restrictive sudoers file in place.

This method can be very effective and you can control how users su "by the minute" if that pleases you. You can create any combination of permissions in sudoers files and move these files in and out of place as you like.

This reminds me of a site I worked for 20 years ago... to do anything you had to be root...

All users should use vi cp mv and rm with caution ( write a script that does rm -i ... or add that as an alias in /etc/profile...) but then you should have groups defined ( by application ? ) where group members are allowed to modify files or add files to thouse group directories and others not...

Hey not bad Neo! Quite original the usage of many sudoers and cron...

Neo, thank you. It seems like a much easier solution to implement for a n00b like me. A buddy suggested using PAM with sudo but to be honest, it is a bit out of my league.