1

I followed a tutorial on how to grant root access to other users and what I did was, in /etc/passwd/ I changed the other users' uid/gid to 0:0.

The problem is that once I block ssh access to user root by changing PermitRootLogin to no in sshd_config, all other users that share the 0:0 uid/gid also loose access via ssh to the box.

The box does not have internet access, so, installing sudo/sudoer to manage users it's not possible.

|improve this question|||||
  • 2
    Where did you find the tutorial that said to change the uid/gid to 0:0? That is truly terrible advice. – Greg Hewgill Jun 24 '14 at 21:48
5
  1. Do not change a user's uid:gid to 0:0.
  2. Do not change a user's uid:gid to 0:0.
  3. Change the uid:gid back to what they were
  4. Running commands that require root privileges should be done using sudo or in certain cases by logging in as root. If you can't install sudo then login via ssh as your non-privileged user and elevate to root using su -

If you've locked yourself out of ssh-ing into your box, then hopefully you have physical access to it or you can reinstall the OS.

|improve this answer|||||
  • What we are trying to accomplish is; not use root for anything (done), stop ssh access to box via root (done), create 3 accounts, 1 that will have root privilege (just like root but under another name, which is why I changed the uid:gid ( tho you just told me not to do it like that ) and last grant the other 2 users application specific privileges. If it's to complicated, I don't mind having 3 accounts with root privileges, but I do need to deny access to the box using the root account, but not to the others that have root privileges. Thank you. – Amalfy Vargas Jun 24 '14 at 21:37
  • @AmalfyVargas: Not using the account named "root", and then using another account with uid 0, is pretty much doing exactly what you said you don't want to do. It's the uid that really matters for security, not the name used to access the account. – Greg Hewgill Jun 24 '14 at 21:50
  • So how do I go about accomplishing what I need; as you can see I am lost as hell and applying changes that are incorrect. Can someone please tell me. – Amalfy Vargas Jun 24 '14 at 21:53
  • @AmalfyVargas Login to the box as user 1 and elevate to root when necessary. Give user 2 & 3 privileges to the application. If you can't do this then think about giving all 3 users the root password even though that is a problem itself. Whatever you decide to do, giving a regular account root privileges is not a solution and tutorials preaching it should be stricken from the Internet. – Creek Jun 24 '14 at 22:50
  • Finally understood what I should have done. I created my 3 regular user logins and an extra 1 that will have the uid:gid of 0:0. also on sshd_config will disable root login. now, to log in to the box I will use 1 of my regular users as you said, and then sudo if necessary to that other extra user I created that also has power like root but it's not called root. I hope I got it right this time and thanks to all who have helped me understand this stupid dilema of mine. Have a great day all. – Amalfy Vargas Jun 25 '14 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.