Allowing users to shutdown - Slack 10.1

amwink · 03-04-2005, 05:58 PM

I think now I've discovered why setting the sticky bit wasn't working... I did the chmod, as KMcD wrote, and continued using sudo as keefaz suggested. Such a mess could not work... I'll pay more attention next time.

In conclusion:

1) Now any user can shutdown just typing /sbin/shutdown -(option) due to the new permissions set with chmod. I'm considering if adding /sbin to the path wouldn't be a good idea... So, my problem is solved (I'm not paranoid about security issues. This is just a desktop computer at home).

2) Sudo also works, but I have to type the password, in spite of the NOPASSWD being set in the /etc/sudoers file. I edited this file using vi (visudo). I'm still wondering where is the mistake. My /etc/sudoers is bellow:

Code:

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# Runas alias specification

# User privilege specification
root    ALL=(ALL) ALL
#ander   ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel        ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=NOPASSWD: /sbin/shutdown -h now
ander     schwarz=NOPASSWD: /sbin/shutdown -h now

If I uncomment the line ander ALL=(ALL) ALL it works, but the password is needed. If I keep it commented (as above), I receive the message "Sorry, user ander is not allowed to execute '/sbin/shutdown' as root on schwarz.".

I'll probably keep it as it is, since now I can shutdown easily without sudo. But if someone knows how to make sudo work, it can be useful for others

Thanks a lot for all.

Ander

cavalier · 03-04-2005, 10:29 PM

Ander--

I'm glad you found a solution that works for you, but I can't let go of the situation.

Are you 100% sure your machine is called "schwarz"? Try using this line:

Code:

ander     ALL=NOPASSWD: /sbin/shutdown -h now

The only other thing I'd consider is using /sbin/halt instead, just to get rid of those arguments...

keefaz · 03-05-2005, 06:42 AM

And make sure you type the command exactly as defined in /etc/sudoers

Eg if you set it like the above,
sudo /sbin/shutdown -r now <-- will not work...
sudo shutdown -h now <-- will not work...
sudo /sbin/shutdown -h now <-- will work...

amwink · 03-05-2005, 01:37 PM

I cannot believe how silly I was being!!

The hostname is correct. However I should have deduced that, if the sudoers file includes the arguments for the shutdown command, it's because such strokes are needed. It would be a complete non-sense to put the command options and not use them.

And in fact I was not typing them EXACTLY as in the sudoers file, but using "0" instead of "now".

Now everything works smoothly.

Thank you all again.

amwink · 03-30-2005, 08:09 PM

I'm back to this thread...

Quote:

However, I confess to cheating with this one: I have XDM as my GUI login screen. And thanks to wish and tcl/tk, I have some buttons on the XDM screen that initiate shutdown or reboot. And since XDM is run as root, that takes care of the whole thing very nicely.

I'm still using the runlevel 3 by default. But some users of this computer are annoyed about having to type 'shutdown -h 0' everytime. I decided to change my runlevel to 4. But I'd like to tweak the XDM as oneandoneis2 said... (I prefer it instead of GDM or KDM).

I've googled and found this http://www.leidinger.net/X/xdm-advanced.html. It's exactly what I need, but the solution in proposed there doesn't work for me.

Another problem: Even after creating a ~/.xsession, XDM loads FVWM and I can't put another window manager to work.

Any suggestions?

amwink

oneandoneis2 · 03-31-2005, 02:27 AM

What have you got IN the xsession file?

And what part of the Wish buttons app doesn't work..? Does it not appear at all, or appear and not work, or what?

amwink · 03-31-2005, 05:32 PM

Quote:

what part of the Wish buttons app doesn't work..?

Such words could not be more clarifying. I never knew that Linux (or X) has a command called 'wish'! Knowing that 'wish' is an application, I just had to type 'whereis wish' to discover that it is in /usr/bin/wish, not in /usr/local/bin/wish as the original script points to. Now the buttons appear and work very well.

And about the ~/.xsession, I figured out that it must be an script, not a simple config file as I thought before. I did 'chmod +x .xsession' and it became working. Now I can choose any WM installed.

Thanks a lot -- again!

amwink

acidjuice · 04-01-2005, 03:22 AM

hello all,

quite an interesting post here.

only one question: i've upgraded to gnome 2.10, and from gnome both as root and as normal user i can only logout, i.e. the options to halt and reboot are gone.

will editing my /etc/sudoers file adding:

Code:

acidjuice     ALL = NOPASSWD: /sbin/halt, /sbin/reboot, /sbin/mount, /sbin/umount, /sbin/shutdown -h now, /sbin/poweroff, /sbin/reboot

...will do?

amwink · 04-01-2005, 08:48 AM

I suppose it will not work. The sudoers file is a configuration for the command 'sudo'. As far as I know, only sudo reads this file. I don't think gnome or any other app will read sudoers. amwink

acidjuice · 04-04-2005, 03:45 AM

i see.

anyone knows how to add these 2 additional options then?

tx,

aj.

smithtodda · 04-11-2005, 11:02 AM

I'm working on this same issue. The first thing I need to know:

What are the permissions for the /sbin/shutdown and /sbin/halt files in a default Slackware 10.1 installation? In other words, what are the results of a "ls -l" on both of these?

More questions will follow that answer.

Thanks.

doraimom · 08-19-2006, 04:08 PM

Hi. I have a question related to everything that was talked here, but instead of using shutdown my problem is with mount.
My users can use the command MOUNT because it's placed in /bin (suse 10.0).
I installed captive to mount a RW ntfs partition. But just ROOT is able to mount these partitions.
So, after reading everything here what I did was:
1) chmod a+s mount AND umount.
2) chmod g+w
3) chowm myname.users mount AND umount

After all these steps, I didn't get any more warning like: "just root can mount or is allowed to mount".
Now I'm getting:
eu@linux:/mnt> mount -t captive-ntfs /dev/sda4 captive-arquivos/

Captive-ERROR **: image_iochannel failed open of: /dev/sda4
aborting...

Can anyone help me to make MOUNT and UMOUNT work for ordinary users, and to mount using captive (NTFS partition) ??

I'll add one more thing here, also related, but easier to answer.
Some of my commands (like SHUTDOWN) don't appear to ordinary users in the command line. For exemple: shutdown in SUSE may be placed in /usr/sbin/shutdown. I could just ADD a link in /usr/bin and it would work, but What I really want to learn is how to set a PATH or ADD this path (/usr/sbin) to all my users, so when they try to execute a command linux won't search for this command only in the path /usr/bin or /bin for exemple.. It will also search for the command in other paths. This will not work only for my ordinary users. It'll work to ROOT as well, because some of the commmands that were supposed to work with root they don't because the PATH to these files/scripts weren't set (all of them) automatically by the OS when I made the installation. This kind of thing happens a lot when I install Fedora, Debian or SUse for exemple. I did learn it once, but I can't remember how to add this paths anymore.

Thank you.

doraimom · 08-19-2006, 04:17 PM

I just solved the first problem adding my users to the group CAPTIVE. So, my only doubt now is with PATH. thks

AlleyTrotter · 08-20-2006, 07:08 AM

I am far from an expert on Slack but,
I do know that changing permissions on the operating system executable is almost always the wrong way to allow ordinary users to do anything.
This introduces all kinds of security problems.

As far as allowing users to mount or umount just add the 'users' option to that filesystem in '/etc/fstab'

wish I could offer more help

dennisk · 08-22-2006, 11:04 AM

Sorry, If I missed an earlier post suggesting this, but if you are booting to the commandline and then starting x with startx and afterwards exiting the session and returning to the commandline this solution works well.

Edit /etc/inittab to change the default CTRL-ALT-DEL to shut down instead of restart. then create this file

/etc/shutdown.allow

and add each users to it that you want to allow shutdown priviledges, one user per line. Now when you do the familar three finger salute at the commandline the computer will shut down.

Dennisk