Is it possible to create a non-root Linux user account without being logged in as a root user and without using sudo?
-
2Why do you want to do this - what is your need?– NilsFeb 3, 2012 at 21:05
Add a comment
|
5 Answers
Boot up into a system rescue CD. Or, if your root account is locked, boot to single-user mode (add 1 to the end of the boot command). Other than that, no. Could you imagine how insecure that would make a system?
-
I don't see any security threat in that. I just want to create an user account with the same privilege I have in my account while I'm logged with my account– SimoneFeb 3, 2012 at 19:40
-
5@Simone You could make dozens of accounts so it's hard for the admin to kick you off the system. Or make a second account and store all your illegal files there. Or just make new accounts to get around per-user restrictions like disk quotas Feb 3, 2012 at 19:49
-
@Simone A comment like this is likely to get you fired in any shop that actually has computer systems helping you make money.– KarlsonFeb 3, 2012 at 20:47
-
@Kevin well even the way you describe it you will be creating accounts as user root. Not all systems allow login without root-password in runlevel 1. And the boot-process as well as the boot menu should be password protected on any halfway secure system.– NilsFeb 3, 2012 at 21:03
-
@Nils Yes, but not the root of his system. My understanding of runlevel 1 is that it requires a password if and only if root has one, but it's possible I'm mistaken. And yes, the boot menu should be protected, but we all know that's not always going to be the case.– KevinFeb 3, 2012 at 21:09
It requires writing in some files. Which happen to be writable only by root. So use a setuid root binary like sudo or be root.
If the system is not being used, just mount the hard driver and edit manually the files you need, there should be binaries on the system to edit the password file/groups and such. I'm more a BSD user so I don't know the names but look for vipw/adduser/useradd/usermgmt/etc.
Are you sure you really need to do that? Managing user is part of the administrator's tasks, so root is the way to go. If someone else can modify system files, there's a security problem.
No. Generally speaking, the unix permission model only has two levels: root, and the rest. Root can do everything, and non-root users each have their own domain. Non-root users cannot create subdomains inside their security domain.
There is a way to create security domains as an ordinary user: run a virtual machine of some kind (VirtualBox, User Mode Linux, …). You can isolate applications running in the VM to your heart's content.
answered Feb 6, 2012 at 23:39
Gilles 'SO- stop being evil'Gilles 'SO- stop being evil'
810k194 gold badges1677 silver badges2177 bronze badges
If the root user wanted to allow this, she could configure PAM to allow it, or even allow it by group membership.
By default, no it cannot be done and I'm not going to write a PAM example.
This is an admin decision and any admin confident (not sure that's the best word) enough to allow this, should be experienced enough to configure PAM without help.
samba has a mode that will create accounts "on the fly". I am not sure if your question is related to Windows-based authenticated access from "new" users.
