New answers tagged

0

Yet another route is to launch a new shell as a different (non-root) user to run commands as that user. ubuntu@aws-ip:~$ sudo -u mongodb bash #<-- or zsh, etc... mongodb@aws-ip:~$ mongod --configsvr --dbpath /data/configdb --fork An example of this is the mongodb user. When deploying a sharded MongoDB cluster, all the necessary processes ...


0

I haven't made an intensive search, but I don't think what you're looking for exists on Linux. Opening a file descriptor doesn't take any global lock, only a per-process lock, so on a multicore machine whatever you'd be using to count the number of open file descriptors could be running literally at the same time that other threads is opening or closing ...


0

I needed to add a dash when switching users in the console. So su - $ALTUSER instead of su $ALTUSER. The dash - is an alias for the -login option of su.


-2

This does the trick for me, at least in Ubuntu: sudo -u martin-test -s It forces you into the shell of the given user. For users who do not have the su requirement, maybe this is an acceptable alternative.


0

passwd is a traditional unix command. lpasswd appears to belong to the libuser project, "a standardized interface for manipulating and administering user and group accounts." % ls -li =passwd =lpasswd 3149052 -rwsr-xr-x. 1 root root 30768 Feb 17 2012 /usr/bin/passwd 3155939 -rwxr-xr-x 1 root root 33240 Jul 10 2015 /usr/sbin/lpasswd % rpm ...


0

Set users shell back to /bin/false (or some other invalid shell) then set /bin/false in /etc/shells. I see a major security issue with setting /usr/sbin/nologin into /etc/shells. You are giving FTP (and perhaps other) access to all daemons and logins that have /usr/sbin/nologin as their shell.


0

On Linux I use: sudo useradd -r -p \* -s /sbin/nologin -c "Comment My Daemon,,," -d "/var/uuu" myuser The next alternative must be more cross platform (if -r option is not available): sudo useradd -K UID_MIN=100 -K UID_MAX=499 -K GID_MIN=100 -K GID_MAX=499 -p \* -s /sbin/nologin -c "Comment My Daemon,,," -d "/var/uuu" myuser Here: password in ...


1

I don't have sufficient rep to comment on Legate's answer, but I wanted to share that this answer helped us with another use case: 1.) account in question is a local service account running an application, not an end user account. 2.) end users ssh in as themselves, and sudo /bin/su <user> to become user and administer application due to an audit ...


0

It sounds like your home directory is not mounted, or not mountable. Running getent passwd MYUSER on the master should show you the home directory for your user; is there a similar directory available on the client? If not, you will either need to share the home directory from the master over NFS, or make a parallel directory tree available.


1

Yes, it's always a very good idea to have an unprivileged account on the system to use when you do not need admin privileges. On systems with X Window (e.g. KDE, GNOME) this is practically mandatory. If you have console-only access it is recommended anyway to have it -- even if you're working all the time as admin. In fact, you should block remote ssh ...


2

If you are neither God nor the Pope, you're not infallible, so prone to make mistakes. ;-) Therefore I would create 2 users: A user that can read everything but not change anything: adduser NormalUserName An "Admin" user that needs the sudo command to change anything. adduser AdminUserName adduser AdminUserName adm adduser AdminUserName cdrom adduser ...


1

The only way to accomplish this without resorting to ACLs is, Permissions set to 750 and your username being a member of every other user's primary group. For instance, lets say you have these users: me user1 otheruser /home will look something like this: drwxr-x--- 2 me me 4096 Mar 3 12:14 me drwxr-x--- 24 user1 user1 4096 Apr ...


0

I Wouldn't advice to become a member of all user groups, but have a look at extended ACLs instead. Read about setfacl and getfacl on the web or the man pages and set default ACLs which allow you to enter the other home directories.


1

As written, you can't meet your requirements. The user is going to have to be able to read some files (the shell, ls, etc). However, it seems to me you are massively overcomplicating this. If all you want them to do is to be able to review the directory structure, just give them a dump of ls -lR.


2

Yes, they can. $ id foo uid=1002(foo) gid=1002(foo) groups=1002(foo) $ id bar uid=1003(bar) gid=1003(bar) groups=1003(bar) Changing the primary group of user foo to bar which is the primary group for user bar: $ sudo usermod -g bar foo Now: $ id foo uid=1002(foo) gid=1003(bar) groups=1003(bar) $ id bar uid=1003(bar) gid=1003(bar) groups=1003(bar) ...


1

From the perspective of the user, he has a primary group and 0 or more secondary groups. From the perspective of the group, it has 0 or more members. A group that is the primary group for one or more users can be both a secondary or primary group for other users.


3

This isn't something you can really control without extremely intrusive testing. You could conceivably attempt to log in as a user with every string you find in their home directory (and sanction the user if you're ever successful), but that's far from reasonable or feasible. You could, though, if this is for secure shell connections, disable password ...



Top 50 recent answers are included