LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 06-10-2012, 10:42 PM   #1
i_am_he
LQ Newbie
 
Registered: Jun 2012
Posts: 3

Rep: Reputation: Disabled
sudo help


lets see if i can explan this..I have two groups groupA and groupB both have sudo ALL. GroupA have to run Foo(script) to do a job which is lets say command RM remove. So groupA runs script Widge to excute RM. GroupB runs Widge2(script) this script job is too start command lets say stop. We do not want group B to run Widge2 "stop". In theory and in practical use what needs to be change in the script Widge2 and the sudoers file so that GroupA and B can run Widge and that groupA and not group B can run Widge2. I think i explained it. Do you have any ideas
 
Old 06-11-2012, 01:32 AM   #2
Slackyman
Member
 
Registered: Mar 2011
Location: Rome - Italy
Distribution: Slackware 13.1
Posts: 347

Rep: Reputation: 44
Code:
%groupA ALL = ALL, !/usr/bin/Widge2
%groupB ALL = ALL, !/usr/bin/Widge
But keep in mind that if a user in the groupA change directory (e.g. "cd /usr/bin") can still run "./Widge2".
I think it's better work with file permissions.
 
Old 06-11-2012, 07:07 AM   #3
i_am_he
LQ Newbie
 
Registered: Jun 2012
Posts: 3

Original Poster
Rep: Reputation: Disabled
thank you i will test it out
 
Old 06-11-2012, 07:35 AM   #4
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,148
Blog Entries: 2

Rep: Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886
Quote:
Originally Posted by Slackyman View Post
Code:
%groupA ALL = ALL, !/usr/bin/Widge2
%groupB ALL = ALL, !/usr/bin/Widge
But keep in mind that if a user in the groupA change directory (e.g. "cd /usr/bin") can still run "./Widge2".
I think it's better work with file permissions.
They don't have to change the directory. It is simple as that: if you give one user (or a group, doesn't matter) the ALL rights in the sudoers file then nothing can prevent them from doing anything, including changing the root password and logging in themselves as root or simply using visudo to change things in the sudoers file.
This approach to security will not work. The intended use of sudo is to give the users only the rights to run the applications as root which they need for their job. It is not meant to give the users all rights and then take away the rights to run some applications. This will theoretically work, but is in the real world simply not maintainable.

So the question to the OP should be: Do your users really need the right to run all applications as root?
 
Old 06-11-2012, 12:57 PM   #5
Slackyman
Member
 
Registered: Mar 2011
Location: Rome - Italy
Distribution: Slackware 13.1
Posts: 347

Rep: Reputation: 44
Yep, sorry.
Remove the ALL reference and give groups only the ability to sudo their relative scripts.
 
Old 06-19-2012, 09:39 PM   #6
i_am_he
LQ Newbie
 
Registered: Jun 2012
Posts: 3

Original Poster
Rep: Reputation: Disabled
TobiSGD
to answer you question as of now all user must run applications as root.
also Slackyman
when i remove ALL should it look like this:
%groupA localhost = !/usr/bin/Widge2
 
Old 06-20-2012, 01:11 AM   #7
Slackyman
Member
 
Registered: Mar 2011
Location: Rome - Italy
Distribution: Slackware 13.1
Posts: 347

Rep: Reputation: 44
Code:
%groupA localhost =  /usr/bin/Widge
%groupB localhost = /usr/bin/Widge2
The group groupA can run as root Widge and the group groupB the same for Widge2.
They're not allowed to run as root any other command or script.
Obviously I don't know where the Widge and Widge2 scripts are so modify this according that.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: The Ultimate Sudo FAQ — To Sudo Or Not To Sudo? LXer Syndicated Linux News 13 04-13-2013 01:36 AM
Can't use sudo, only account that's not root is not a sudo'ers [Ubuntu 9.10] randyriver10 Linux - Desktop 1 01-09-2010 07:56 PM
Problem with SUDO : sudo: pam_authenticate: Module is unknown cristoph_ Linux - Software 2 03-02-2009 07:12 PM
sudo blkid vs. sudo fdisk -l problems alienexplorers Linux - Newbie 1 01-13-2009 12:35 AM
Restricting Editing in Sudo (Advanced Sudo Question) LinuxGeek Linux - Software 4 11-04-2006 03:20 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 08:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration