LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   How do I enforce in Red hat linux that only root user be a member of the "root" group (https://www.linuxquestions.org/questions/linux-security-4/how-do-i-enforce-in-red-hat-linux-that-only-root-user-be-a-member-of-the-root-group-695918/)

sultf 01-08-2009 02:41 PM

How do I enforce in Red hat linux that only root user be a member of the "root" group
 
I don't want any other user to be part of "root" group except user root.

alan_ri 01-08-2009 03:50 PM

First backup your /etc/group file with;
Quote:

cp /etc/group /etc/group.SAVE
from the terminal,then open /etc/group file with the text editor.The first line will be root's group,just delete any user you don't want it there and save the file.
For example,my line looks lke this;
Quote:

root:x:0:root,alan
so if I want only root to be in that group then I would delete alan and the , and then I would save that file.Done.

sultf 01-08-2009 04:09 PM

Thanks for the reply. But, I don't want anybody to add a user under the root group. e.g If somebody tries to add user by issuing the following cmd, he/she should not succeed.

useradd -g root -p mypasswd myuser

jailbait 01-08-2009 04:19 PM

Red Hat installs by default to not allow a user to issue the useradd command. They could only do so on your system if you have changed the default configuration.

-----------------------
Steve Stites

rweaver 01-08-2009 04:42 PM

Quote:

Originally Posted by sultf (Post 3401497)
I don't want any other user to be part of "root" group except user root.

Only root and people allowed to sudo/su would be able to addusers. In neither case are you going to be able to prevent them from adding themselves or other accounts to the root group. You would also need to remove sudo and su access at which point they can't add users or change the groups file.

PS- Secondary thought: Check the perms on your /etc/group file... should be something like 644 (-rw-r--r--)... make sure its not world writable basically.


All times are GMT -5. The time now is 04:30 AM.