Need Suggestions on Sudo on RHEL 5

coolinux · 10-10-2009, 05:44 AM

Hi All,

I need information on sudo, well coming to the point, I have a user named user1, and I want to assing him few privileges, that is I want him to assign few commands so that he can execute the commands in my absence.

I have opened the suoders file with visudo, however, when I did some googling, I found that (username ALL=ALL), but I don't want to assign him the root privileges, instead I want to assign him only few commands, say like creating a parition using fdisk and all.

What I know: I understand that I need to search the path of the particular command(which fdisk)and put it into visudo file, however, what i want to know is where and how to (syntax) insert the line in the sudoers file.

Any and all suggestions will be appreciated.

Thanks....

eth1 · 10-10-2009, 05:54 AM

The syntax of the file is pretty explanatory,

Quote:

user MACHINE=COMMANDS

So if the username is 'eth1' and you want to provide access to the command /sbin/mount to the user then,

Quote:

eth1 ALL=/sbin/mount

~sHyLoCk~ · 10-10-2009, 05:58 AM

Example:

Quote:

username ALL=NOPASSWD: /sbin/fdisk

Find out the path of command using

which fdisk or etc..

tommylovell · 10-10-2009, 09:16 AM

You can also split the specifications up using User_Alias and Cmnd_Alias to make it a little easier to organize.
Here is a contrived example for ya'.

Code:

### User Aliases

## This is a list of users that have the ability to sudo the same commands.
User_Alias    USERLST1=user1,user2

## This group has the ability to sudo the same commands.
## 'webadmgp' is a primary or secondary group that some of your users have.
User_Alias    WEBGROUP=%webadmgp


### Command Aliases

## Storage
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Networking
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Webadmin
Cmnd_Alias WEBADMIN = /etc/rc.d/init.d/httpd


### The Commands Section

## The USERLST1 users (user1 and user2) can sudo all the commands listed in Cmnd_Alias STORAGE.
## They don't need to enter a password.

USERLST1 ALL=NOPASSWD: STORAGE

## The WEBGROUP users (every user that has 'webadmgp' as a primary or secondary group)
## can sudo all of the commands listed in the NETWORKING an WEBADMIN Cmnd_Alias lists.
## They don't need to enter a password either.

WEBGROUP ALL=NOPASSWD: NETWORKING,WEBADMIN

Where things go doesn't seem to be important.

When you save the file, 'visudo' will tell you if you have a syntax error or some inconsistancy.

And be careful if you cut and paste into the file. If you cut a single long line that has wrapped on your screen, it'll paste in as multiple lines. When you file, 'visudo' will complain...

chrism01 · 10-11-2009, 07:33 PM

Syntax:
user machine=(runas) cmds

runas = user to run cmd as; you don't always want the root user.
http://linux.die.net/man/5/sudoers