Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Am wondering whether it's possible to create a user in ubuntu 11.10 server with custom sudo rights.I mean by that an use who can start and shutdown the box but who can't access /var/www for example or be able to change ip of the box via /etc/network/interfaces and restart the networking and only access specific files both system and custom in /etc/init.d/* .

Such things can be done? thanks

EDIT: This is the first time we are deploying a software on the linux box. so it's a combination of php application running in apache2 with a reporting server in tomcat with other applications bundled in 2 jars. these jars are used as services to their configurations have been added to /etc/init folder. So Ideally we would want to protect the /var/www/ourapp folder, /var/lib/tomcat6/webapps/ourreporting if possible.allow the client user to restart the box, change the ip restart the networking, start and stop our services, apache2, tomcat6 see the logs /var/logs/apache2|tomcat6and that should be all

share|improve this question

3 Answers 3

Yes, you can - but it's worth considering what you're trying to protect against.

Most ideal would be hardened binaries that do one task only, and validate their inputs quite carefully.

Certainly things like changing /etc/network/interfaces - you don't want them calling out to an editor as root - you want them generating a new file with their standard editor and then you want that file installed over the top safely.

But note: if they're changing IPs they also need a way to take the interface down and back up again.

And then they can install anything they like as an "up" or "down" script on an interface and whoopdy-yay, they have root.

So basically - it's complex, it's a pile of holes waiting for a creative enough person to exploit. So I ask again - what are you trying to protect against and is this something you can solve at a people level rather than a technical level?

share|improve this answer
    
Hello thanks for your response, i edited the post with what we are trying to protect. –  black sensei Jul 25 '12 at 12:57
    
What's missing is why you want to solve this technically (actually REALLY HARD) rather than by only allowing people you trust enough not to be complete twonks onto your box. What is the downside of them accessing your www tree? –  Bron Gondwana Jul 26 '12 at 13:26
    
Also - backups. Who's doing them, and what level of access do they have? –  Bron Gondwana Jul 26 '12 at 13:27

open /etc/sudoers file

# /etc/sudoers

#

# This file MUST be edited with the 'visudo' command as root.

#

# See the man page for details on how to write a sudoers file.

#

Defaults env_reset

# Uncomment to allow members of group sudo to not need a password

# %sudo ALL=NOPASSWD: ALL

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification

root ALL=(ALL) ALL

# Members of the admin group may gain root privileges

%admin ALL=(ALL) ALL


write below line inside /etc/sudoers file

yourusername ALL=(ALL) ALL

then you will become sudoer

share|improve this answer
    
in place of yourusername write your name like sensei, but that sensei name account must be present in the system. –  max Jul 25 '12 at 12:16
1  
He doesn't want users to become root in general. He wants a user to be able to do a few things as root, not everything. –  wullxz Jul 25 '12 at 12:34
    
he will not become root, if he try to see a /etc/sudoers file he will get a error like "Permission Denied" see here –  max Jul 25 '12 at 13:11
    
IIRC, the sudoers manpage tells, that your line yourusername ALL=(ALL) ALL permits user yourusername to run ALL applications as ALL users (including root) on ALL hosts. So, if you would have used visudo, you should've got access to /etc/sudo/sudoers. –  wullxz Jul 25 '12 at 13:48
    
I tried with visudo to open /etc/sudoers file but it's showing like this [suraj@avi ~]$ visudo /etc/sudoers usage: visudo [-c] [-q] [-s] [-V] [-f sudoers] –  max Jul 25 '12 at 13:58

Check this article to allow the shutdown command for specific users. You can also give that permission to a group according to this howto. I'd suggest to create a group called shutdown and put all users with shutdown permission in that group.

As long as you don't elevate those users to admins (put them in specific groups), they shouldn't have access to /var/www.


Update: according to Bron Gondwana, my following suggestion is dangerous because users could open anything with vi, once it is started as root.

AFAIK, you can create an alias in users ~/.bashrc (or in /etc/bash.bashrc for system-wide settings) like alias viinterfaces="vi /etc/network/interfaces" and give the user access to viinterfaces like described in one of the above articles. I currently don't have a linux on my hand, so you have to test this suggestion or wait for another superuser to confirm or decline that this works.


share|improve this answer
    
this is actually really dangerous. Once they're in vi as root, they can do pretty much anything. –  Bron Gondwana Jul 25 '12 at 11:59
    
thanks for your hint. I edited my suggestion to show that it's not save. I'll leavy it there in case someone will come to that thought without reading it here so he'll read that it's not save. –  wullxz Jul 25 '12 at 12:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.