Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to allow certain users limited access to the lab server. The server is RedHat Enterprise Linux (RHEL) 5.6. However, I don’t want to give them the root access. Basically, we have configured a LDAP server where all the users have centralized NFS and LDAP login from any of the client machines in the network. So, the LDAP users home area is located in /home/users in the server. I need to give access to only this folder to a certain user.

If I edit the visudo file and add the following line, will I be able to accomplish what am looking for?

user1, %operator ALL= /home/users
share|improve this question
    
If I'm remembering my sudo syntax right, no. That will let user1 or group operator be able to sudo from any machine/address, and run a command called /home/users. (1) If you want to give a user access to a privileged command, but not other commands, that'll be a way to go. (2) Or, you could accomplish your goal using standard Unix perms, by simply creating a group called ldapgrp and include user1 and all the users who are in the "operator" group. Then apply standard Unix-type perms to the dir. (3) I have no current comments to make on whether ACLs would be easier to create or maintain. – TOOGAM Oct 12 '15 at 20:42

IF I understand you correctly, you want to give a certain user full read/write privileges on the /home/users directory and subdirectories. You're not looking to have that user run processes as room, correct? If so, then sudo may not be the best mechanism. You may want to consider using Access Control Lists (ACLs) to give the user access to those files. They could then read (and write if desired) the files using just their normal user account without the need to sudo.

You will need to mount the file system with ACL support (usually the "acl" option). Then you will need to give your target user the appropriate level of access using the "setfacl" command. I recommend you read the manual page and also check out:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/Deployment_Guide/ch-acls.html

This goes into pretty good detail on how to set ACLs. Be sure to set the default ACLs for directories as well so that new files and directories get the correct ACLs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.