we have CENTOS 5.2 on DELL server. we need allow a user can "su" to another user without password.
for example:
account user1 can "su - user2" without password. (user2 is NOT root)
I know this is big security risk but .... Anyone know how to do it?
Thanks.
On Thu, 19 Aug 2010, mcclnx mcc wrote:
we have CENTOS 5.2 on DELL server. we need allow a user can "su" to another user without password.
for example:
account user1 can "su - user2" without password. (user2 is NOT root)
man sudo
---------------------------------------------------------------------- Jim Wildman, CISSP, RHCE jim@rossberry.com http://www.rossberry.com "Society in every state is a blessing, but Government, even in its best state, is a necessary evil; in its worst state, an intolerable one." Thomas Paine
mcclnx mcc wrote:
we have CENTOS 5.2 on DELL server. we need allow a user can "su" to another user without password.
for example:
account user1 can "su - user2" without password. (user2 is NOT root)
I know this is big security risk but .... Anyone know how to do it?
Thanks.
Check out the sudo command. You can alter the /etc/sudoers file to specify that the "source" user can only run a command as a specified "runas" user. The syntax would look something like:
sourceuser ALL = ( runasuser ) command
Let's say you wanted the user "bob" to be able to run the "grep" command as user "fred". The following line could be added to the /etc/sudoers file:
bob ALL = ( fred ) /bin/grep
"bob" would use the sudo command to execute the grep command:
sudo -u fred /bin/grep 'stuff' logfile
This is a simplistic example, check the man pages for "sudo" and "sudoers" for more information.
Thank you for answer. The problem I have is "user1" need "su" privilege. If I grant "su" privilege, it can "su" to anyone. What I want is user1 can ONLY "su" to user2.
my /etc/sudoers setup:
# User privilege specification root ALL=(ALL) ALL user1 ALL=(root) /bin/su
any ideal to fix it?
--- 10/8/18 (三)，Jay Leafey jay.leafey@mindless.com 寫道：
寄件者: Jay Leafey jay.leafey@mindless.com 主旨: Re: [CentOS] how to setup account which can 'su" to another account (NON-root)? 收件者: "CentOS mailing list" centos@centos.org 日期: 2010年8月18日,三,下午8:05 mcclnx mcc wrote:
we have CENTOS 5.2 on DELL server. we need allow
a user can "su" to another user without password.
for example:
account user1 can "su - user2" without
password. (user2 is NOT root)
I know this is big security risk but .... Anyone
know how to do it?
Thanks.
Check out the sudo command. You can alter the /etc/sudoers file to specify that the "source" user can only run a command as a specified "runas" user. The syntax would look something like:
sourceuser ALL = ( runasuser ) command
Let's say you wanted the user "bob" to be able to run the "grep" command as user "fred". The following line could be added to the /etc/sudoers file:
bob ALL = ( fred ) /bin/grep
"bob" would use the sudo command to execute the grep command:
sudo -u fred /bin/grep 'stuff' logfile
This is a simplistic example, check the man pages for "sudo" and "sudoers" for more information. -- Jay Leafey - jay.leafey@mindless.com Memphis, TN
-----內含下列夾帶檔案-----
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
On Thu, Aug 19, 2010 at 9:56 AM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Thank you for answer. The problem I have is "user1" need "su" privilege. If I grant "su" privilege, it can "su" to anyone. What I want is user1 can ONLY "su" to user2.
my /etc/sudoers setup:
# User privilege specification root ALL=(ALL) ALL user1 ALL=(root) /bin/su
any ideal to fix it?
Use complete command like this: user1 ALL=(root) /bin/su - user2 This will limit user1 to that specific command. You can add -NOPASSWD and user1 will not have to enter their password. John
This work correctly. Thanks.
--- 10/8/19 (四)，John Kennedy skebi69@gmail.com 寫道：
寄件者: John Kennedy skebi69@gmail.com 主旨: Re: [CentOS] how to setup account which can 'su" to another account (NON-root)? 收件者: "CentOS mailing list" centos@centos.org 日期: 2010年8月19日,四,上午10:00
On Thu, Aug 19, 2010 at 9:56 AM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Thank you for answer. The problem I have is "user1" need "su" privilege. If I grant "su" privilege, it can "su" to anyone. What I want is user1 can ONLY "su" to user2.
my /etc/sudoers setup:
# User privilege specification
root ALL=(ALL) ALL
user1 ALL=(root) /bin/su
any ideal to fix it?
Use complete command like this:user1 ALL=(root) /bin/su - user2This will limit user1 to that specific command. You can add -NOPASSWD and user1 will not have to enter their password. John-- John Kennedy
-----內含下列夾帶檔案-----
_______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Better still would be
user1 (ALL)=user2 /bin/bash
Leave off su entirely and
sudo -H user2 -i
as user1
On 19 Aug 2010 15:57, "mcclnx mcc" mcclnx@yahoo.com.tw wrote:
This work correctly. Thanks.
--- 10/8/19 (四)，John Kennedy skebi69@gmail.com 寫道：
寄件者: John Kennedy skebi69@gmail.com 主旨: Re: [CentOS] how to setup account which can 'su" to another account
(NON-root)?
收件者: "CentOS mailing list" centos@centos.org 日期: 2010年8月19日,四,上午10:00
On Thu, Aug 19, 2010 at 9:56 AM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Thank you for answer. The problem I have is "user1" need "su" privilege.
If I grant "su" privilege, it can "su" to anyone. What I want is user1 can ONLY "su" to user2.
my /etc/sudoers setup:
# User privilege specification
root ALL=(ALL) ALL
user1 ALL=(root) /bin/su
any ideal to fix it?
Use complete command like this:user1 ALL=(root) /bin/su - user2This will
limit user1 to that specific command. You can add -NOPASSWD and user1 will not have to enter their password.
John-- John Kennedy
-----內含下列夾帶檔案-----
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Sorry. following way does NOT work. user1 (ALL)=user2 /bin/bash Leave off su entirely and sudo -H user2 -i as user1
--- 10/8/19 (四)，James Hogarth james.hogarth@gmail.com 寫道：
寄件者: James Hogarth james.hogarth@gmail.com 主旨: Re: [CentOS] how to setup account which can 'su" to another account (NON-root)? 收件者: "CentOS mailing list" centos@centos.org 日期: 2010年8月19日,四,上午11:22
Better still would be user1 (ALL)=user2 /bin/bash Leave off su entirely and sudo -H user2 -i as user1 On 19 Aug 2010 15:57, "mcclnx mcc" mcclnx@yahoo.com.tw wrote:
This work correctly. Thanks.
--- 10/8/19 (四)，John Kennedy skebi69@gmail.com 寫道：
寄件者: John Kennedy skebi69@gmail.com 主旨: Re: [CentOS] how to setup account which can 'su" to another account (NON-root)? 收件者: "CentOS mailing list" centos@centos.org
日期: 2010年8月19日,四,上午10:00
On Thu, Aug 19, 2010 at 9:56 AM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Thank you for answer. The problem I have is "user1" need "su" privilege. If I grant "su" privilege, it can "su" to anyone. What I want is user1 can ONLY "su" to user2.
my /etc/sudoers setup:
# User privilege specification
root ALL=(ALL) ALL
user1 ALL=(root) /bin/su
any ideal to fix it?
Use complete command like this:user1 ALL=(root) /bin/su - user2This will limit user1 to that specific command. You can add -NOPASSWD and user1 will not have to enter their password.
John-- John Kennedy
-----內含下列夾帶檔案-----
CentOS mailing list CentOS@centos.org
-----內含下列夾帶檔案-----
_______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
On Thu, Aug 19, 2010 at 11:47 AM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Sorry. following way does NOT work.
user1 (ALL)=user2 /bin/bash
Leave off su entirely and
sudo -H user2 -i
as user1
Probably should be 'sudo -H -u user2 -i'
HTH
Mark
On Thu, Aug 19, 2010 at 2:47 PM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Sorry. following way does NOT work. user1 (ALL)=user2 /bin/bash Leave off su entirely and sudo -H user2 -i as user1
Because you have to run sudo -i -u user2 as user1
On 19 August 2010 20:12, Tom H tomh0665@gmail.com wrote:
On Thu, Aug 19, 2010 at 2:47 PM, mcclnx mcc mcclnx@yahoo.com.tw wrote:
Sorry. following way does NOT work. user1 (ALL)=user2 /bin/bash Leave off su entirely and sudo -H user2 -i as user1
Because you have to run sudo -i -u user2 as user1 _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Missed the right bit off the top of my head on the train on the way home.... you can always check the man pages for arguments.
-
James Hogarth -
Jay Leafey -
Jim Wildman -
John Kennedy -
Mark -
mcclnx mcc -
Tom H