Tag Info

Hot answers tagged

10

The major difference between sudo and su is the mechanism used to authenticate. With su the user must know the root password (which should be a closely guarded secret), while with sudo the user uses his/her own password. In order to stop all users causing mayhem, the priviliges discharged by the sudo command can, fortunately, be configured using the ...


8

In Linux/Unix the user with user id 0 is such a super administrator. The user is usually called "root", but the magic is really behind the id and not the name. That user is especially not bound to local file access permissions and can read and write any file. That user also has the ability to change to any other user without needing a password.


6

There are two commands related to root privileges, SUDO and SU. With SUDO, you don't become another user (including root). SUDO has a pre-defined list of approved commands that it executes on your behalf (this addresses what I asked in the comment about how you give selected users selective privileges). Since you are not becoming root or another user, you ...


5

R Perrin has it right. But it is a far better thing to login to a system via ssh as a "normal user", and become root should the need arise. One of the recommended hardening activities for a *NIX box is to disallow remote root login.


5

Does your system use Pluggable Authentication Modules (PAM)? Most modern Linux or BSD use PAM. PAM allows you to hook into logins. There are a variety of PAM modules available which might meet your needs, or you can write your own in C. There is even a pam-python* binding which allows you to hook in Python code. Given that you want the daemon to be running ...


4

Working from the vsftpd version 2.2.2, there are two options for keeping users in a chroot jail: chroot_list_enable Just add users to the chroot list e.g. (/etc/vsftpd/chroot_list) that you want placing in a chroot jail. chroot_local_user This will place all local users in a chroot jail, however, if this is set then the chroot_list becomes a list of ...


3

groups show you the groups you are in. So the problem is that your process thinks you still are in the now deleted 1001 group, from the deluser myuser 1001 command. You still would get that error message from groups as long as the process you started thinks you are in the group. When doing these kind of things in bash for my own account, I normally start a ...


3

Workaround using GNU parallel. parallel --nonall --sshloginfile .cluster --tag w In my case I use a file .cluster, which contains the hostnames where I want to run the command: $ cat .cluster n04 n05 n06 My output n04 11:19:43 up 110 days, 20:54, 2 users, load average: 0.16, 0.24, 0.25 n04 USER TTY FROM LOGIN@ IDLE JCPU ...


3

The name “administrator” comes from the Windows world. In the Unix world, “system administrator” is a job description, but “administrator” doesn't mean anything special with respect to accounts. Unlike Windows, Unix accounts do not intrinsically have a notion of privilege. The privileges in an account are conferred by the files that they can access, by the ...


2

As root, you may issue su - username You will not be prompted for a password.


2

You can use namei -m /path/to/really/long/directory/with/file/in which will output all of the permissions in the path in a vertical list. or namei -l /path/to/really/long/directory/with/file/in to list all owners and the permissions


2

From the man page of useradd (8): It is usually recommended to only use usernames that begin with a lower case letter or an underscore, followed by lower case letters, digits, underscores, or dashes. They can end with a dollar sign. In regular expression terms: [a-z_][a-z0-9_-]*[$]? On Debian, the only constraints are that usernames must neither ...


2

Short answer is you can't. If you allow someone (e.g. simth) in sudoer's group, he can issue a sudo su - then become root, then anoter user (e.g. wesson). This is an alternate way of giving root's password to simth. However he (smith) can change root passwd. Notes also that 1) you must specify in /etc/sudoers a line like %sudo ALL=(ALL:ALL) ALL 2) ...


2

You don't need systemd for that. know who is logged in since when Use who $ who jimmij tty7 2014-09-25 01:39 (:0) jimmij pts/0 2014-09-25 01:39 (:0) jimmij pts/2 2014-09-28 22:14 (:0) or even better w to get additional information $ w jimmij tty7 25Sep14 12days 4:09m 5:24 sawfish jimmij pts/0 25Sep14 53:43 ...


2

This is a known problem, if you ssh as root somewhere and then su to become a normal user: $ ssh root@server # su -l anthon $ screen Cannot open your terminal '/dev/pts/3' - please check. It is e.g. described in these posts from 2005 The solution is to directly login as the user you want the screen session to run as.


1

It might be possible for a sufficiently crafty/devious user to defeat this, but you should be able to catch most logins if you put a command into /etc/profile to notify your daemon.  It could be something simple, like running who am i with output redirected to a fifo that your daemon would read.


1

The file permissions specifically do not allow read, write or execute of that file to the owner (user1). If you were to change the owner to another user, then you would be able to read the file under the group permissions. Excert from File system permissions wiki page Classes ... The effective permissions are determined based on the user's class. ...


1

You can edit the field by editing the file, or you can use usermod -c, although nowadays it is called the comment field in man 5 passwd, this was not always the case, it used to be the GECOS field on UNIX, although that name did not reflect the use it had: providing general information. The proper population is a comma separated list of four (possible ...


1

Have a look at man usermod it shows the -c option which is used to modify the comment field for an account in /etc/passwd. example: usermod -c "raspberry pi user account" pi To update the comments field for the 'pi' user account.


1

The order of operations that causes the expired password prompt is as follows: SSH runs the PAM account stage, which verifies that the account exists and is valid. The account stage notices that the password has expired, and lets SSH know. SSH performs key-based authentication. It doesn't need PAM for this, so it doesn't run the auth stage. It then sets ...


1

You don't need systemd for that … but there's a systemd way of doing it as well, as long as you are running the systemd-logind daemon, or something that provides the same API. First obtain a list of sessions: $ systemd-loginctl list-sessions SESSION UID USER SEAT c89 1000 jdebp seat0 ...


1

Your understanding is wrong. root is all-powerful, and becoming other users is a critical part of root's usefulness.


1

The user name "administrator" is not a reserved name with implied privileges, it is just a user name and I can use it without inadvertently defeating inherent security? You get root privileges by having a user ID number of 0. If the user "administrator" has a different ID number, it will just be a regular user The effects of using the SU command in ...


1

Your apache and PHP scripts should be running under the same user. One idea you might come up with (This is garethTheRed's idea) is to create a www-devs group which contains your developers, change the ownership of /www-data to apache:www-devs, and set the mode to 0570. This will result in the web server able to read from the directory, but not write to ...


1

The general rule for username is its length must less than 32 characters. It depend on your distribution to make what is valid username. In Debian, shadow-utils 4.1, there is a is_valid_name function in chkname.c: static bool is_valid_name (const char *name) { /* * User/group names must match [a-z_][a-z0-9_-]*[$] */ if (('\0' == *name) || ...


1

If I understand you correctly, you want to change the owner of all files inside some directory (or the root) that are owned by user #500 to be owned by another user, without modifying files owned by any other user. You're in that situation because you've copied a whole directory tree from another machine, where files inside that tree were owned by many ...


1

The prefix the guide refers to is the WINEPREFIX environment variable. It is used to point wine to the configuration directory it should use. You can keep a separate 32-bit configuration for your main user by pointing WINEPREFIX to a directory other than $HOME/.wine, e.g. export WINEPREFIX=$HOME/.wine-32/ export WINEARCH=win32 winecfg Note that this ...



Only top voted, non community-wiki answers of a minimum length are eligible