2

I'm curious if there is a way to enable one user to login (via su) into another user, without needing to know that users password. For instance, if I'm logged in as user1, I would like to give user2 permission to log in to me, but for whatever reason it's infeasible for him to know the password. Let's say the reason is because I use a random string of 20 uppercase/lowercase/numbers. For clarification, I don't just want access to that users files, I want to be fully logged in as that user.

Via ssh, this is easy, I grab his public key, stick it in .ssh/

If user1 happens to be root, it's easy, I just give NOPASSWD access in sudoers.

Perhaps the solution is: use ssh to do it. But, that's inelegant, isn't it? And it seems very inelegant if this is only possible for root, but no one less important than root.

Extra points: Can this be set up without root being the one who sets it up? Again, the ssh solution solves this problem, but inelegantly.

Improve this question
1

How is setting up an ssh public key "inelegant"? I'd say that's the right way to do it, and it doesn't require root access; just append user2's public key to ~user1/.ssh/authorized_keys. If user2 is logged into the system, he can just type ssh user1@localhost with no significant network overhead.

You could also configure /etc/sudoers so that user2 can run sudo su user1 and/or sudo su - user1 without entering a password. (This doesn't get the extra points, since it requires root access to configure /etc/sudoers.)

Improve this answer
  • 1
    It's inelegant, in my opinion, because it's using a networking protocol to effect a user switch. I guess my thought is that if ssh is the elegant way to switch users, then what's the point of even having su for switching users? – wdahab Mar 5 '12 at 13:44
  • 1
    @wdahab: For one thing, su is older than either ssh or sudo. su is necessary because it works even if networking doesn't (including on systems that are so old they don't have networking). But it's unlikely that a network connection to localhost will fail -- and sudo su does something similar without using the network at all. Personally, I just wouldn't worry about the inelegance. – Keith Thompson Mar 5 '12 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.