[SOLVED] learning useradd

Ankit yadav · 06-22-2017, 05:20 AM

We can create user only with super user permission. While /usr/sbin/useradd has 755 permission. why can’t we create user with my user id which don’t have root privilege’s ?

wpeckham · 06-22-2017, 05:59 AM

Why would any security or system administrator want just any user able to create new users without limitations? Why would any system be set to allow that? What might be the consequences if it were set that way, and misused?

With Linux comes great power (and you know how the rest of that goes), but the defaults are set in an attempt to not allow you too many ways to shoot yourself in the foot. In what way is it inconvenient to run useradd using sudo, or usign gui tools that do that FOR you?

Ankit yadav · 06-22-2017, 06:10 AM

Thanks for your reply.
Yes I understand one user(without root privilege) should not create another user for security reason. But my question here is directory /usr/sbin/useradd has permission 755 or even if we give 777 permission, it wont let create user. Why? With this permission even other user can execute useradd.

!!! · 06-22-2017, 06:15 AM

Suggest web-researching the basics of the Unix/Linux concept of UID 0, root, superuser powers.
Also, chmod and SUID. Or give everybody the root password

Use strace -f on your # useradd: things like passwd,shadow,group,gshadow may need to be world-writeable to make your zero-security work.

Simply one chmod +s will 'break' your system, to accomplish what you want. I tested it.

Again, web-research the concept of suid.

Note that changing 755 to 777 only adds write-ability, nothing to do with x=execute-ability.

wpeckham · 06-22-2017, 06:15 AM

There are MANY programs that you can run (to get information, the help/usage screen for example) that check your authority and will not let you do things you are not authorized to do. Some of these will allow you to make changes to a user IF IT IS YOU, but only root/superuser can change someone ELSE.

Have you read the man page?

Rickkkk · 06-22-2017, 08:08 AM

Quote:

Originally Posted by Ankit yadav

Thanks for your reply.
Yes I understand one user(without root privilege) should not create another user for security reason. But my question here is directory /usr/sbin/useradd has permission 755 or even if we give 777 permission, it wont let create user. Why? With this permission even other user can execute useradd.

Hi Ankit yadav,

I think you are confusing file/directory permissions (which determines who can read, write, execute ... etc.) with the authority to run certain programs. It is not the same. Some of our members have already suggested reading up on these aspects of linux, I second this recommendation.

If, after doing so, you still have questions, feel free and welcome to return here for assistance.

Cheers :-) !

Ankit yadav · 06-23-2017, 08:16 AM

Thanks all.
I got confused here.
In Simple words, programs in /usr/sbin only run by root.

B-RAH · 06-26-2017, 01:44 PM

Be careful not to simplify in saying "programs in /usr/sbin only run by root" That's not technically the case... /usr/sbin/useradd looks for current users ID, and NOT the UGO permissions, and allows execution based on that, just like certain scripts. Think of this for example:

if [ "$(id -u)" != "0" ]; then
echo "Permission denied"
exit 1
fi