UNIX for Dummies Questions & Answers

Scenario: Admin wants to grant user temporary access to sudo that will expire on an arbitrary date\day. Say, after 10 days, sudo rights disappear automatically.

I'm sure there's a way to hack something together with a script or cron job, but I was wondering if anyone has a package \ tool \ other that automates and makes this easy? If not, how do you recommend implementing it with cron \ script?

OS is Red Hat 6.x.

Thanks!

I don't know any tools and don't have RHEL6 right now, but if your sudo is compiled with --with-env-editor, you can use any editor with visudo command to change /etc/sudoers. Then the "tool" could be something like this:

Code:

# echo -n "/username/\nd\nw\nq\n" | EDITOR=/bin/ed visudo

and all you need is to run it with at now + 10 days.
You can check, if your sudo compiled with --with-env-editor using the -V switch as root:

Code:

sudo -V

N.B. I didn't test it.

random quick idea. make the sudo rule group based and setup the job to remove the user from that group on the day the access should be revoked.

Somewhat flawed, but we use "at" and "usermod -G group-name user-name" to add a user to a group and "gpasswd -d user-name group-name" to remove. Two jobs, one to initiate, and one to end access and then as @frank_rizzo pointed out, we use a rule in sudo to allow access for that group-name.