0

I have logged into UNIX environment with user1, in this environment i have a shell script which containing some task need to be done at different path with different user say user2 because user1 do not have access to that path.

I want to switch to user2 from user1 in shell script for doing that task, and after completing the task i want to switch again to user1 from user2.

Please suggest, how I can achieve this scenario.

I am calling shell script with java so if you have any another way then please suggest

1

You can achieve what you want with sudo: you can allow user2 to execute the script it needs as user1, allowing only that script to be executed, thus preserving the security of your system (user2 cannot go rogue and use a shell as user1). You can do that by:

  1. sudo visudo (to edit the sudo configuration file)
  2. Add this to the end of the file: user2 ALL = (user1) NOPASSWD:/path/to/your/script.sh
  3. Save and close the file.

Now, if you open a shell as user2, you can use sudo -u user1 /path/to/your/script.sh to execute it as user1; you can use this very same command from java. Security is preserved, as user2 cannot execute a shell as user1: sudo -u user1 bash will be denied.

However, i think an ever cleaner solution would be achieved by just creating a group that user1 and user2 will share, and using that group to manage execution permission for the file. Depending on your requirements, you might also want to consider ACLs, or the setuid bit (e.g. chmod 4700 /path/to/your/script.sh) if more users are expected to execute that script as user1.

  • Like that, very nice. What if bash or a command is injected to the script? Will it be smart enough to still deny it? – Blake Russo Dec 16 '16 at 13:03
  • With the sudo solution, the script would be executed with full user1 permissions; that's all there is to it. Injected commands would be executed as user1, so without further protection (e.g. SElinux) you wouldn't be able to prevent injected command execution (e.g. trough an environment variable). That's also why i think the grouping solution is better: user2 would retain its identity during the script execution, along with its permission context. – Mario Vitale Dec 16 '16 at 14:15
0

I assume the user1 does not have password-less sudo access, correct? If it does you can use the runuser command.

runuser -l user2 -c 'whoami'

You can just use su/sudo if you have sudo permissions setup.

su - user2 -c 'whoami'

However I assume you don't have password-less sudo and/or you may not have the password for user2. You could be tricky by generating an RSA keypair for user1 then appending the id_rsa.pub key to user2's $HOME/.ssh/authorized_keys file to enable RSA Public Key Authentication then use SSH to do it without a password.

As user1 run the following; ssh keygen Just press enter through the prompts Then run the following to add the key automatically (you can do this manually to). If you are using this command you will need user2's password the first time only.

ssh-copy-id -i $HOME/.ssh/id_rsa.pub user2@hostname

If this works you should be able to login as user1 then run ssh user2@localhost to login as user2 without a password. Make sure /etc/ssh/sshd_config on the server has PublicKey Authentication enabled.

Then to remotely execute command you can run something like;

ssh user2@localhost "remote-command1;remote-command2"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.