Sudo access to another user's account

Question

what will be the most efficient way for multiple users (around 15) to be able to sudo to another user's account to run privileged commands?

so to make it clear, I have a main user called mainaccount that has sudo/root access, I also have 15 other users that need to be able to change or run commands su - mainaccount for managing a test environment.

how can I do this?

Edit: I am asking how is this done, so if user user1 wants to run a command as mainaccount (su - mainaccount) but without putting mainaccount's password, rather using their own password. I guess kind of like the wheel group, where you can add multiple users but this one just to be able to change or run commands as mainaccount

Answer 1

That (and making back-ups) is pretty much the traditional use of the operator user and group...

Set up a group - eg. mainusers - and add the users allowed to "become" mainaccount

In /etc/sudoers add: %mainusers ALL = (root) su - mainaccount This will let members of mainusers become mainaccount by using su - mainaccount. By doing so as root, they don't need to give a password for the su-command. Alternative %mainusers ALL = (mainaccount) ALL lets members of mainusers to run any command as mainaccount.

Let mainaccount-user be member of the sudo-group (ie. may sudo to root and run commands as root). This will let any user first becomming mainaccount to then use sudoto become root.

---

That said, this sounds like a bad idea! It may be better to let mainaccount - and users belonging to mainusers who could become him - to only be allowed to run a limited number of privileged commands (perhaps only the commands in a dedicated directory), maybe as root. sudo can be used to set-up this too.

You may look at man sudoers -- and in the example sudoers-file in /usr/share/doc/sudo/examples/ -- for more inspiration. Look especially how they use alias and the operator-user/group in the example-file. Here "operators" may do daily maintenance work -- like shut-down the computer, kill processes, start/stop/add printers, mount CDROMs, and such things -- but far from everything root (and members of sudo-group) can do. This is a more appropriate set-up for allowing "trusted users" doing some day-to-day admin-work. If you're running several computers, it may also be a good idea to limit their privileges to only one or two computers (eg. groups of users have special rights on "their" computer, but not on the other computers).

So if I was you, I would think twice and perhaps rethink this - especially the number of users you intend to "promote". If you have to do this; I would suggest the operator-solution - put them in a group, and use sudo to give them a limited set of privileged commands they could run (as root) to fix day-to-day problems. But don't let them all be able to ascend to full root-status! If you really need someone with full root-privileges, then pick a couple among the dozen that you really trust and knows are knowledgeable, and add them to the sudo-group as full co-administrators... that would be a lot cleaner and easier to control than what you proposed.