Tag Info

New answers tagged

0

Sudoers file won't work like that, or so it seems to me. Sudoers file is intended to give a specific command access, not to the specify the arguments that can go with that command. Create a script that runs as root and executes this: /usr/bin/systemctl start database@ Make the script take an argument such as anotherawesomeapp so it executes this: ...


0

Programs do not search for libraries in the same directory as the executable by default. The traditional directory organization under Unix has executables in directories called …/bin and libraries in directories called …/lib. if you set prefix=~/.local when compiling software, you'll end up installing the executables in ~/.local/bin and the libraries in ...


1

What is your distribution? Does your distribution have rtmpdump available as a binary package? Debian does, for example, and therefore Ubuntu and Mint should as well, for example. If so, why aren't you using it? In any case, apt-file search librtmp.so librtmp-dev: /usr/lib/x86_64-linux-gnu/librtmp.so librtmp0: /usr/lib/x86_64-linux-gnu/librtmp.so.0 ...


0

It fails, because sudo is trying to prompt on root password and there is no pseudo-tty allocated. You've to either log-in as root or set-up the following rules in your /etc/sudoers (or: sudo visudo): # Members of the admin group may gain root privileges. %admin ALL=(ALL) NOPASSWD:ALL Then make sure that your Jenkins user belongs to admin group (or ...


1

It's safest to itemize them as jofel suggests. If I wanted to allow someone to use a limited subset of a command's abilities, I would not trust wildcards in a sudoers line to do it. Even if the language was more expressive than shell globs, there are just too many corner cases to keep track of. The "service httpd *" line is relatively safe because (verify ...


2

Just add all needed commands to sudoers separately: %webteam cms051=/usr/bin/systemctl restart httpd.service %webteam cms051=/usr/bin/systemctl stop httpd.service %webteam cms051=/usr/bin/systemctl start httpd.service %webteam cms051=/usr/bin/systemctl status httpd.service


0

Sudo would be the tool of choice and you could divide the accesses up by group. Create the 3 groups you want as administrators add the users you want in each group. Set your command aliases in /etc/sudoers Cmnd_Alias APPADM = /usr/bin/yum Cmnd_Alias USEADM = /usr/sbin/useradd Cmnd_Alias NETADM = /usr/bin/service network * And then the group ...


1

The simple fact is that if a person can arbitrarily install programs then they probably can install a program that will run under root privileges, so they could install programs that would grant them other types of access. IE any person who can install or modify something that is run as root, is or can easily become root. If you want to separate out your ...


1

sudo has ways to give users access to some, but not all, commands through sudo. You can use the visudo command to safely edit the /etc/sudoers file, with some syntax checking before the file is really saved. Inside the file, you can add a line like mike ALL=(root) /usr/bin/aptitude, /usr/bin/apt-get to give mike access to aptitude and apt-get through sudo, ...


2

You have to have someone have access to the root account to provide additional privileges. Beyond that, you can use sudo to limit effect areas of control for other administrators without giving them root. But overall, what you're describing seems to be more of a political / training issue than a technical issue. Hire the right staff, and they won't get in ...



Top 50 recent answers are included