sudo equivalent configuration on Solaris 10

Question

I am looking to configure on Solaris 10 to achieve the below:

user=jon
group=jtu
jon is owner of /opt/app

user=ken
group=jtu
ken is owner of /data

On Linux I have added the below line

%jtu ALL= NOPASSWD: /bin/*, /usr/bin/* 

so that jon is able to access /data/tmp and delete files.

This doesn't work on solaris10 since there is no sudo by default. How do I configure Solaris 10 so jon can delete files in /data/tmp?

Thanks

Answer 1

Many standards packages for sun are available at http://www.sunfreeware.com/

Navigate to solaris10 x86 or sparc depending on your architecture, and search for sudo in the list presented.

you may find it will need one or two other packages from there as well. These packages are installed using the pkg_add tool in solaris. Once sudo is installed (in /usr/local) you can configure as you would a normal sudo, config file is in /usr/local/etc/sudoers if I remember correctly.

however, if you're willing to entertain a method on both platforms that doesn't involve elevated (root) privilege, what you're wanting to do can more simply be achieved by setting /data to a particular group that both accounts are a member of, and setting group write flag using chmod g+w /data. Group semantics should honor that flag for new files and directories created underneath. To chgrp exsting files you would do :

chgrp -R common_group /data
chmod -R g+w /data

Answer 2

the equivalent of sudo on solaris is pfexec:

• http://developers.sun.com/developer/technicalArticles/opensolaris/pfexec.html
• http://www.c0t0d0s0.org/archives/4844-Less-known-Solaris-features-pfexec.html
• http://www.softpanorama.org/Solaris/Security/solaris_rbac.shtml

maybe you should use that instead of a 3rd party sudo.

Answer 3

Role Based Access Control (RBAC) is the native Solaris way. http://docs.oracle.com/cd/E19683-01/806-4078/6jd6cjs5r/index.html

Alternatively, install the sudo package from the additional apps CD or get from sunfreeware.com or blastwave.org

easier solution: chmod 775 /data/tmp; chgrp jtu /data/tmp That way jon can remove files in /data/tmp since he is member of jtu group

Or you can use setfacl (earlier versions of Solaris 10) or set your ACL's with chmod in newer versions of Solaris 10.