Hi,

is there any way how to give a limited root access to another administrator? This administrator only takes care of windows client machines and he needs root access for adding a machine to the domain (Samba acting as PDC) when the client PC is reinstalled (quite often )

Thanks for your time

The answer to your problem is a simple program named sudo.

Be sure NOT to give access to interactive editors such as vi that allow shell commands. If you do, what is going to stop him from nulling out the root password or changing his own uid to 0? Use the least privilege approach.

Links:
http://www.onlamp.com/pub/a/bsd/2002...y_Daemons.html

Thanks for the answer, but I have no clue how to use sudo with Samba.
Can u give an example how to set it up?

When u want to add a windows machine to the domain, the first login to the domain must be done as root (from the client).

I'm not on a linux machine right now (I am deployed to Iraq and sitting in a free cyber cafe!) So I can't play around with Samba. I normally use nfs but here is basicly what you need to do.

1.) Document all commands that your PDC Admin routinely or will at some time use.

2.) Create a group named sambadm and add all of the users you want to be samba admins to this group.

3.) Create a '/etc/sudoers' file and add all of your permissions to it.

touch /etc/sudoers

The format for the /etc/sudoers file is very simple
username host = command

Here is an example:

%sambaadm PDC = /usr/bin/smbpasswd,/usr/sbin/useradd,\
/sbin/newfs,/sbin/newfs_msdos,/sbin/mount
Now the user just types 'sudo smbpasswd' or whatever they need to type. It will prompt them for their own password and then will execute. If you use the NOPASSWD option like the one listed in the last link, they won't even need a password. I hope this helps

Links:
http://www.courtesan.com/sudo/sudo.html sudo homepage
http://www.linuxhomenetworking.com/linux-hn/samba.htm
http://www.linuxhomenetworking.com/linux-hn/sudo.htm
http://lists.debian.org/debian-user/.../msg03647.html
http://www.onlamp.com/lpt/a/2680
http://www.courtesan.com/sudo/sample.sudoers check this out for some ideas

OK, thanks I ll give it a try when I get back to the office.