That (and making back-ups) is pretty much the traditional use of the operator user and group...
Set up a group - eg. mainusers - and add the users allowed to "become" mainaccount
In /etc/sudoers add:
%mainusers ALL = (root) su - mainaccount
This will let members of mainusers become mainaccount by using su - mainaccount
. By doing so as root, they don't need to give a password for the su
-command. Alternative %mainusers ALL = (mainaccount) ALL
lets members of mainusers to run any command as mainaccount.
Let mainaccount-user be member of the sudo-group (ie. may sudo
to root and run commands as root). This will let any user first becomming mainaccount to then use sudo
to become root.
That said, this sounds like a bad idea! It may be better to let mainaccount - and users belonging to mainusers who could become him - to only be allowed to run a limited number of privileged commands (perhaps only the commands in a dedicated directory), maybe as root. sudo
can be used to set-up this too.
You may look at man sudoers
-- and in the example sudoers-file in /usr/share/doc/sudo/examples/ -- for more inspiration. Look especially how they use alias and the operator-user/group in the example-file. Here "operators" may do daily maintenance work -- like shut-down the computer, kill processes, start/stop/add printers, mount CDROMs, and such things -- but far from everything root (and members of sudo-group) can do. This is a more appropriate set-up for allowing "trusted users" doing some day-to-day admin-work. If you're running several computers, it may also be a good idea to limit their privileges to only one or two computers (eg. groups of users have special rights on "their" computer, but not on the other computers).
So if I was you, I would think twice and perhaps rethink this - especially the number of users you intend to "promote". If you have to do this; I would suggest the operator-solution - put them in a group, and use sudo
to give them a limited set of privileged commands they could run (as root) to fix day-to-day problems. But don't let them all be able to ascend to full root-status! If you really need someone with full root-privileges, then pick a couple among the dozen that you really trust and knows are knowledgeable, and add them to the sudo-group as full co-administrators... that would be a lot cleaner and easier to control than what you proposed.
mainaccount
can become root (passwordlessly), then anyone who can becomemainaccount
can become root. That said, set up a group for the users, and insudoers
, set up a stanza saying "members of this group cansudo su - mainaccount
."mainaccount
how do I escpefically add the users so they can su - mainaccount?sudo
is to configure the execution of specific elevated commands to specific users and/or groups. If you engineer a method for users to first become another user before usingsudo
, you'll have a hard time learning or proving who did what. Why not focus on configuringsudo
commands for a certain group, and put your users in that group?