hai,

Here is another one. I want to make a user , who can be able to do all the jobs an root can do(some exceptions can be there). How to set the rights/permissions for him.


Thanks in advance.

Consider using sudo it's quite good for giving users some of the root privileges

A very simple n fastest way is to change the user/group id of that user to "0". This will make him like root.

Thank you avallach and mether

but mether is there any other way to do this??

Hi,
I'd go with the earlier advice and use sudo to do this. If you explain a little more about what it is you're trying to do we might be able to offer some further advice.

Regards,
Jim

I mean , If there is a root and his assistant root1.
i want to make root1 can do almost all of the jobs of root,ie., a user root1 will be given some rights to add/del/change user settings, managing services, configuring of server settings, monitoring etc.,,

what mether told is perfectly working. But it is dangerous., i mean , by doing this the user completely becomes a root, he can be able to change the root passwd too.

So try my advice, you can easily set using visudo command... To give an user the permissions that really suit you.

Hi,
The first thing you need to do is determine exactly what you want your non-root power user to be able to do. Only once you've got a tight specification for the limited powers you need to give this admin account can you successfully lock it down.

Once you've done that determine exactly how you are going to allow the user to do the jobs in hand. If you need to allow them to change all passwords other than root you might need to do some creative scripting or modify the passwd command. Consider using an existing administration tool that allows this kind of granular access control. I can't think of one for Linux off the top of my head, perhaps someone else can throw us a bone.

Jim

Look at the below links which will help you in undestanding more abt sudo.

http://kbase.redhat.com/faq/FAQ_80_3474.shtm

http://kbase.redhat.com/faq/FAQ_44_585.shtm

http://kbase.redhat.com/faq/FAQ_80_3754.shtm

Yeah, this is where unix permissions really fall down. You can't give a user root-ish permissions over X,Y and Z but not everything else. Hence we have complex crazy solutions like SELinux which let you impose a different security model, or stupid solutions like sharing the root password, or the imperfect but probably the most reasonable solution of using sudo.

Another option is to make the stuff you want your assistant to manage belong to a group, be group writable and make your assistant a member of that group. Of course, if it's adding/removing certain accounts but not all accounts, that's not going to work...