Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am new to system administration. We have a lab set up where we have a server and client machines. The client machines have LDAP users which has the work area for all the users in the centralized server. So whenever an user logs in, his work area will be mounted through the NFS service in the client machines and all his work will be saved to the server when he logs out.

Now, I want to give a local user in the server limited root access. I want this local user to be able to view the home directory of all the LDAP users and nothing else. I believe I am looking for wheel user in the server. I also believe I should make some changes in the visudo file to allow limited root access to the local user in the server.

user1, %operator ALL= /home/users

I tried adding the above command in the visudo file for the local user user1. I also added the user to the wheel group like below.

usermod -G 10 user1

However, I do not see any changes. Why didn't my approach with sudo work?

Since this approach doesn't seem to be working, I asked: Allow a user to read some other users' home directories

share|improve this question
    
why did you think that line in sudoers would help? i forget the exact syntax but it looks like that works for the operator group, not wheel. –  strugee Sep 19 '13 at 20:04
    
and did you read man sudoers? –  strugee Sep 19 '13 at 20:05
    
yeah. I am editing the sudoers file by running the command visudo. The file is /etc/sudoers. I am adding the line user1, %operator ALL = /home/users in the sudoers file. However, I do not see any change for that particular user (user1). –  Ramesh Sep 19 '13 at 20:07
    
I know. You said that in your question. I'm asking if you read the documentation before coming here. –  strugee Sep 19 '13 at 20:28
    
@Ramesh local user is ldap user or not ? –  Rahul Patil Sep 19 '13 at 21:01

3 Answers 3

up vote 1 down vote accepted

Couple of things:

  1. The command sudo is for elevating yourself to a higher level of credentials for either a command or set of commands, not for gaining access to a directory with which you (1) aren't either the owner, (2) in a group that has read permissions to said directory, or (3) the directory doesn't have the other permissions opened to the world.

  2. The file /etc/sudoers is the file that contains all the rules for a given system and stipulates which users, groups of users, can run which commands in an elevated way as root, typically, or some other user account. You typically do NOT want to edit this file directly, though you can, it's best not to do so.

  3. The command visudo is the prescribed way for editing the /etc/sudoers file.

  4. If you want to see what sudo credentials a user has access to, the simplest way is to become that user and run the command, sudo -l.

    $ sudo -l
    Matching Defaults entries for saml on this host:
    env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
    LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
    
    User saml may run the following commands on this host:
    (ALL) ALL
    (root) NOPASSWD: /usr/lib/jupiter/scripts/bluetooth, (root) /usr/lib/jupiter/scripts/cpu-control, (root) /usr/lib/jupiter/scripts/resolutions, (root)
    /usr/lib/jupiter/scripts/rotate, (root) /usr/lib/jupiter/scripts/touchpad, (root) /usr/lib/jupiter/scripts/vga-out, (root) /usr/lib/jupiter/scripts/wifi
    

wheel access

I believe you're referring to the users' group wheel, which is an old way (to my knowledge) way of granting users permissions to become root via su -. This article does a good job of discussing the use of this group, titled: Administering your Linux system.

Granting access to /home/<user>?

To my knowledge there is no systematic way to do this without giving this user elevated privileges in other ways that you're trying to limit. I would say that if you do not trust this particular user the responsibility of having access in this fashion then they are probably not the right person to be doing this work!

Groups

For example. Say I have 2 students and 1 TA. Students (user1 & user2) TA (user3).

So the groups would be as follows:

  • class1
  • vboxuser1

So when I logged into the system as any of the above users (1-3), my groups would be as follows:

$ groups
users vboxusers class1

This groups would also need to be set on the student's home dirctories:

$ ls -l /home/user1 | head -3
total 37784
drwxrwxr-x   2 saml class1     4096 May 16 22:02 alsa
drwxrwxr-x  31 saml class1     4096 Mar 26 12:09 apps

This is just one idea, it has issues with this approach, but given the information you've provided is "one way to do it"!

share|improve this answer
    
ok, I get it. I have LDAP users whose home is located under /home in the server. For example, if I have 2 LDAP users (user1 and user2), I have the following folders in the server. /home/user1 and /home/user2. I am creating a local user in the server (serveruser). Now I need to give permissions to serveruser to view /home/user1 and /home/user2. Is it possible anyways in Linux? –  Ramesh Sep 19 '13 at 20:40
    
@Ramesh - as I stated, there is no way to do this easily. You could for example use Access Control Lists (ACLs) but this would then require that you systematically apply these to each user's /home/user# directory for user serveruser. This is typically not done because it becomes a maintenance nightmare. If you don't trust this admin, then find another one that you do. –  slm Sep 19 '13 at 20:43
    
It's not that I do not trust the user. I am the system administrator in the school. So, I want to give the permissions to the /home directory to the teaching assistants to evaluate the homework assignments of students. So, I kind of need to give access to the user without giving the root password to him. –  Ramesh Sep 19 '13 at 20:45
    
Is there a group that is common to the various groups of users that aligns with the teaching assistants? I would assign the TA's to this group as well, then they would be able to gain access to these groups without issue. ACLs would be your other option, but this would require you to apply the TA's username as having read access to a variable group of /home/user# directories. –  slm Sep 19 '13 at 20:47
    
Yeah. All the students in the lab belong to the "vboxusers" group. Now, are you suggesting me to create user accounts for the GTA's in the vboxusers group? After I create user accounts how can I make the TAs view other users folders too? –  Ramesh Sep 19 '13 at 20:50

Now, I want to give a local user in the server limited root access.

This sounds like a bad idea.

First, there's the issue of data privacy - if you don't trust this user to have full root permissions, why do you trust him with the data of your users?

Secondly, even if you would somehow manage to grant this user limited root access to /home (which I don't think is possible), there are now several ways for him to gain full root access that you are probably not expecting:

  • He can create a symlink to /:

    cd /home
    ln -s / evil-symlink
    

    Now he can access the contents of the root filesystem as /home/evil-symlink/ as root, because it's located inside /home.

  • He can create setuid executables inside /home. Just copy /bin/bash to /home/bash, do chmod u+s /home/bash and you have your own root shell.

They only way to limit a user to a certain directory regardless of permissions that I can come up with is chroot, and it's common knowledge that root can break out of a chroot.

share|improve this answer

First, what you did wrong:

user1, %operator ALL= /home/users

This allows user1 to run any command in the directory /home/users as any user. If there is no executable program in that directory, the rule effectively does nothing. If there are executable programs there, the rule allows user1 to run them.

You cannot use sudo to give users permission to access file, only permission to execute a command as another user.

See Allow a user to read some other users' home directories for a way to do what you're trying to do.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.