Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

is there a way we can authorize a command typed by a user before it takes effect?

For example, when a user types cp file1 file2, the command will not be executed and a root / root-equivalent user would have to login to 'authorize' the command typed by the user.

Is there such a tool / solution that can do this?

share|improve this question
    
What do you want to accomplish? –  schaiba May 6 '13 at 9:16
    
Hi @schaiba. Control and visibility over what users are doing. For example, if we could limit the SFTP command and users are allowed to do it only when administrators authorize it, it would limit users from transferring file as they please. –  JasperM May 6 '13 at 9:35
5  
You could have the user submit their commands on a stack of punch cards and execute all their commands in a batch for them (after reviewing them for authorization). Note: this increases the latency of job entry, and you really don't want to drop the stack of cards on the floor. –  msw May 6 '13 at 11:07
2  
An experienced user would get around many if not all of those restrictions. "cp file1 file2" would turn into "cat < file1 > file2" (or use dd, or any other number of commands). –  Tim B May 6 '13 at 11:42
1  
@JasperM if your goal is to prevent unauthorized transfer/reading of files within sftp, then that's what file permissions are for. Just don't give them read access and set the default mask on the directory's ACL to deny read access to world. If you need to give permissions to more than one group or user, use ACL's instead of just traditional permissions. Once you give a user read access, they can by definition transfer the files (since that's basically a read-only operation on the server side). –  Bratchley May 6 '13 at 12:18

3 Answers 3

You can replace any binaries you want to approve usage of with a wrapper that will alert the operator, store the action requested and delay it until it is approved. Just remove the execute and read permissions from the programs in question (for the users in question) and place a wrapper with the same name somewhere in the path of those users. (The removal of read permission is necessary to prevent execution of the programs by feeding them to their appropriate interpreters.)

However, you might want to ask about the general idea of such detailed supervision on the security SE. To me it seems to create more problems than it solves (if it solves anything) - my feeling is that you are trying to cook an omelette by smashing apples with a hammer (i.e. using wrong tool in wrong place to achieve something).

share|improve this answer
2  
+1 "smashing apples with a hammer" –  msw May 6 '13 at 11:10

There is no basic mechanism to authorize commands because this is mostly pointless. The core unix permission mechanism is about protecting access to data. If you can read the data, you can do anything you want with it. For example, it's impossible to “allow reading but prevent copying” (copying is just reading in one place and writing in another place), so why try?

If you don't want a user to access a file, don't give them permission to access it.

If you occasionally need users to obtained controlled access to a file, email works. “Hello Bob, I need access to the file wibble because of Reasons. Please send it to me.”

share|improve this answer

You can set those set those to run only with sudo and create a asksudo command that send this to the root user(s)

This might be a good start (only works when for root when it is logged in):

PS: I didn't test it, it might contain errors

function asksudo {
  # for users
  write root "asksudo from $(whoami):"
  write root "\"$(whoami)\" \"$(PWD)\" && $*"
}
execsudo {
  # to authorize root executes this with yes/no and the last line of the message
  if [ "$1" = "no" ]
    then
      write $2 "Your command '${*:3}' has been denied" && exit 0
      exit 1 # fails to send the message
  fi
  [[ "$1" != "yes" ]] && echo "invalid decision" && exit 1;

  cd $3 && ${*:4}
  write $2 "Your command '${*:3}' has been executed"
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.