Linux Security – Allow One User to su to Another Without Root Access

linuxSecuritysudo

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root).
For instance, I'd like to allow Tom the DBA to su to the oracle user, but not to the tomcat user or root.

I imagine this could be done with the /etc/sudoers file – is it possible? If so, how?

Best Answer

Yes, this is possible.

In /etc/sudoers the item immediately following the equals is the user that the command will be allowed to execute as.

tom  ALL=(oracle) /bin/chown tom *

The user (tom) can type sudo -u oracle /bin/chown tom /home/oracle/oraclefile

Related Solutions

Allow user act as root, so he does not need to use sudo each time

In general, this is a bad idea, however if you really require this, then modify the following in /etc/sudoers:

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
<username>    ALL=(ALL)       ALL

## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL
<username>      ALL=(ALL)       NOPASSWD: ALL

Or you can just use vipw and set the uid to be 0 for that username.

Security – Our security auditor is an idiot. How to give him the information he wants

First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.

The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.

This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.

Best Answer

Related Solutions

Allow user act as root, so he does not need to use sudo each time

Security – Our security auditor is an idiot. How to give him the information he wants

Related Topic