Tag Info

Hot answers tagged

8

The --disabled-password option will not set a password, meaning no password is legal, but login is still possible (for example with SSH RSA keys). To create an user without a password, use passwd -d $username after the user is created to make the password empty. Note not all systems allow users with empty password to log in.


4

This is a known problem, if you ssh as root somewhere and then su to become a normal user: $ ssh root@server # su -l anthon $ screen Cannot open your terminal '/dev/pts/3' - please check. It is e.g. described in these posts from 2005 The solution is to directly login as the user you want the screen session to run as.


4

When a user invokes sudo -l it lists what sudo will allow them to do, so you could have a script ran as root that bumps through /etc/passwd and sudo's to each user, invoke the sudo -l, directing the output to /tmp/${USER}_sudo_i_can_do.txt But if you don't have root access, you won't be able to do what you want to do; the list of permissions is readable ...


3

nothing is guaranteed. root - is usually on linux/unix systems, but - i saw systems where uid=0 was used by "admin". Usually - there are users like root, nobody, daemon, bin, sys. www-data is on debian/ubuntu, but for example on redhat/centos/fedora/pld there is apache user instead. Recomendations/fixed uids for users other than root are only within ...


3

Just add all needed commands to sudoers separately: %webteam cms051=/usr/bin/systemctl restart httpd.service %webteam cms051=/usr/bin/systemctl stop httpd.service %webteam cms051=/usr/bin/systemctl start httpd.service %webteam cms051=/usr/bin/systemctl status httpd.service


3

I believe you can use pmount instead. It's in the Debian 7.7 repos. $ apt-cache search pmount libpmount-dev - portable mount library - development files libpmount0.0 - portable mount library - shared library pmount - mount removable devices as normal user Usage $ pmount -h Usage: pmount [options] <device> [<label>] Mount <device> ...


3

There are two options, comment out the Defaults requiretty setting from /etc/sudoers as you mentioned or use the pseudo-tty allocation (-t) argument for ssh. Try the following in your jenkins script: ssh -t 127.0.0.1 "sudo command" Although you will have to have ssh pre-shared keys configured to yourself and run it once manually to add an entry to ...


3

I use JuJu which basically allows to have a really tiny linux distribution (containing just the package manager) inside your $HOME/.juju directory. It allows to have your custom system inside the home directory accessible via proot and, therefore, you can install any packages without root privileges. It will run properly to all the major linux ...


2

I'm not certain why @mtneagle got down-voted. The three items the OP wanted are: The platform type (dmidecode -s system-product-name) The BIOS version (dmidecode -s bios-version) The amount of physical memory (dmidecode -t17 | grep Size) We can get each of these thusly: dmesg | grep "DMI:" | cut -c "6-" | cut -d "," -f "1" dmesg | grep "DMI:" | cut -c ...


2

What you're using isn't KVM directly, but a management library called libvirt. You can specify a user which will have access to libvirt's setup (and thus creating VMs and pretty much running virsh commands) by adding the users to the libvirtd and kvm groups on the host. You can also use policykit to manage access, the procedure is described in the libvirt ...


2

The solution I found was to run the following: sudo sed -i \ 's/allowed_users=console/allowed_users=anybody/' /etc/X11/Xwrapper.config Note, that in your situation, the console may be root or another, based on your particular initial configuration*


2

The Bluetooth protocol stack for Linux checks two capabilities. Capabilities are a not yet common system to manage some privileges. They could be handled by a PAM module or via extended file attributes. (see http://lxr.free-electrons.com/source/net/bluetooth/hci_sock.c#L619) $> sudo apt-get install libcap2-bin installs linux capabilities ...


2

You have to have someone have access to the root account to provide additional privileges. Beyond that, you can use sudo to limit effect areas of control for other administrators without giving them root. But overall, what you're describing seems to be more of a political / training issue than a technical issue. Hire the right staff, and they won't get in ...


2

TL;DR The working solution is using patchelf (if you have to deal with non-matching glibc versions: in the host system and the one nix libs have been linked with), see the second half of my story. Trying the usual approach Trying to use LD_LIBRARY_PATH Well, I have set up an environment variable for this in ~/.bash_profile: ...


2

It's safest to itemize them as jofel suggests. If I wanted to allow someone to use a limited subset of a command's abilities, I would not trust wildcards in a sudoers line to do it. Even if the language was more expressive than shell globs, there are just too many corner cases to keep track of. The "service httpd *" line is relatively safe because (verify ...


2

The only thing that comes close is iostat from the sysstat suite which also works for regular users or maybe atop -d (fails with a floating pointing exception here). Nearly same question was already asked here: http://serverfault.com/questions/260818/in-absense-of-iotop-which-command-is-most-appropriate-for-get-i-o-bounded-proces iotop doesn't work for ...


2

The problem is not occurring because of the UID of the user. 500 is just fine as a UID, and that UID doesn't make it a 'non-login' user except in the eyes of the default settings of some few display managers. The error message No protocol specified sounds like an application-specific error message, and an unhelpful one at that, but I am going to guess that ...


2

Above and beyond the question of whether it's a good idea (it opens up the potential for a non-root user to fill up the root filesystem, causing havoc), you could accomplish this in several different ways: chmod a+w / -- to give "other" write permission chgrp somegroup /; chmod g+w /; usermod -G somegroup user -- to change the group ownership of / to a ...


2

If it's standard for /dev/rtc0 to belong to the audio group in Arch, you could just add yourself to the audio group (using adduser; you'll need to log out and log back in for the change to be effective). Alternatively, you could add an ACL giving yourself access to the device (look up setfacl to see how to do this). Ideally you shouldn't need to access the ...


2

Some package managers support relocation. RPM in particular supports relocation, where the package itself has been built to support it. More information on rpm --relocate at rpm.org:Relocatable packages A comment by the maintainer of yum in 2008 (Seth Vidal) suggests that support for relocation within yum is unlikely. yum mailing list:Yum relocate option


2

Have you tried just using su? Most of the time the default user on a livecd has passwordless sudo, and can also su passwordlessly to any other user.


2

you can try it installing nix using PRoot or you can build for your custom prefix NIX_STORE_DIR=/opt/custom/store \ NIX_STATE_DIR=/opt/custom/var/nix \ NIX_DB_DIR=/opt/custom/var/nix/db \ nix-build ...


2

It tends to get a little messy. You get folders like bin/, etc/, include, lib/ and source/ in your home folder. By choice, yes. If that seems untidy, you can use ./configure --prefix=$HOME/mytools Instead. You will then need to add that to your $PATH, or, if $HOME/bin is already part of it, you could move everything currently there into ...


1

Well, to be sure, you'll need to run that script with escalated permissions. Imagine that someone has an suid program inside the following directory: $ ls -ld sneaky d--x------. 2 user111 g1 4096 May 26 17:19 sneaky $ ./sneaky/test.sh runs Your script will not be able to find that file, even if your program runs as user user111.


1

There are two types of filesystem drivers: kernel or userland. Kernel filesystem drivers are the classical type. They are faster, but since they run kernel code, it is hard to control what they do. For this reason, by default only the system administrator (the root user) can mount a filesystem using a kernel filesystem driver. The administrator can ...


1

Depending on what files you want, you can create a new group (/etc/group) and make the file writable (and the directory containing it if you want the user to create new files) by that group (e.g., chgrp <groupname> <file>; chmod g+w <file>


1

You have to use commands su or sudo. Just adding user to group wheel or adding in sudoers is not enough. The su command switches to the root user – when you execute it with no additional options. You will have to enter the root account’s password. This isn’t all the su command does. You can use it to switch to any user account. If you execute the su john, ...


1

What is your distribution? Does your distribution have rtmpdump available as a binary package? Debian does, for example, and therefore Ubuntu and Mint should as well, for example. If so, why aren't you using it? In any case, apt-file search librtmp.so librtmp-dev: /usr/lib/x86_64-linux-gnu/librtmp.so librtmp0: /usr/lib/x86_64-linux-gnu/librtmp.so.0 ...


1

The simple fact is that if a person can arbitrarily install programs then they probably can install a program that will run under root privileges, so they could install programs that would grant them other types of access. IE any person who can install or modify something that is run as root, is or can easily become root. If you want to separate out your ...


1

sudo has ways to give users access to some, but not all, commands through sudo. You can use the visudo command to safely edit the /etc/sudoers file, with some syntax checking before the file is really saved. Inside the file, you can add a line like mike ALL=(root) /usr/bin/aptitude, /usr/bin/apt-get to give mike access to aptitude and apt-get through sudo, ...



Only top voted, non community-wiki answers of a minimum length are eligible