Is there a way I can grant a user or a group the permission to add/edit other users without the ability to alter anything else on the system? The idea is to give helpdesk agents the ability to grant access to others, but not perform any other system maintenance tasks.
Add a comment
|
1 Answer
No this is not possible using the Unix permissions models that are available via the /etc/passwd and /etc/shadow files and sudo.
One method that I've seen used in the past, was to provide a frontend web application and/or program or shell script that that could execute via sudo, but nothing else. This would provide them an API to perform a very narrow set of tasks through the "application", without giving them the actual capabilities through sudo or general access to the useradd & usermod commands.
