| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 9758.1 | I think you want 'sudo' | DECC::SULLIVAN | Jeff Sullivan | Thu May 08 1997 13:13 | 7 |
| I think you want to use 'sudo', which is a public domain program that allows
ordinary users to have temporary root privileges to run "superuser" programs. It
relies on a file that you set up, so you can control who has the power.
See topics 4883 and 9575 in this conference for more info.
-Jeff
|
| 9758.2 | or is there a reason you might want to avoid su? | QUARRY::petert | rigidly defined areas of doubt and uncertainty | Thu May 08 1997 13:13 | 8 |
| The usual method of doing this is to give the user the ability to
'su' to root. On the first line of /etc/group, the system group
has only 'root' as default. Add additional users with
,usrname on the same line. Then they can just su anytime they
need to. Giving a regular userid all the other privledges of
root tends to go against the grain of unix philosophy.
PeterT
|
| 9758.3 | People doesn't want operator have root pass. | HGOVC::SIUKEUNGLEE | | Thu May 08 1997 22:05 | 8 |
| The reason why is :
Customer doesn't want their operator have the root password.
Any Suggestion.
David Lee.
|
| 9758.4 | | NABETH::alan | Dr. File System's Home for Wayward Inodes. | Thu May 08 1997 23:41 | 10 |
| Discounting very high level security schemes where is root
isn't all powerful, root on most UNIX system IS all powerful.
If a particular account has the same "privileges as root
then that account IS root, even if the name is different.
Some pieces of software may check the name "root", but
the kernel checks for UID zero.
If the customer believes that having an account with UID
zero that doesn't require the root password to get into
is protecting something, they're very wrong.
|
| 9758.5 | Look for other notes on this topic | SMURF::MAJESKE | | Tue May 13 1997 11:26 | 12 |
| There are many ways to allow a non-root user to run specific commands
that require root privilege. "sudo" is one, "dop" is another (just
make sure that you get the most up to date patch for "dop" since the
original created a security hole). You could also create a program
(with the set uid bit set) to run the specific command(s) needed, but
since there are secure programs supplied that do this already, you
should probably stick with the existing programs. It is very easy to
create a security hole when you're writing this type of program.
There are many notes in this notes file on this topic with much more
detail. A search for "sudo" and "dop" will find most of them.
|