2

This question already has an answer here:

I have a red-hat system with its root and non-root users. I have to create n new root-like users and m new non-root users. Basically I have to clone the 2 kind of users already present on the server. The purpose is to give to each person able accessing to the server their unique credentials. Someone can act as root, someone else can act as a non-root user.

I considered it different than giving root power to another user, because I have to create new root-like users.

marked as duplicate by Kusalananda, Anthony Geoghegan, dhag, Rui F Ribeiro, jimmij May 4 '17 at 19:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    sudo is the usual mechanism for this. You can give certain users direct access to the privileges required with pam_cap.so but there's often administrative overhead involved with that. – Bratchley May 4 '17 at 15:25
  • sudo, but consider also capabilities. – ctrl-alt-delor May 4 '17 at 16:48
1

Just create the normal user accounts as usual (useradd perhaps, or some GUI tool if you like). For the users you want to give root access, you have two choices.

Either (a) use sudo, and add the accounts of the admin users to /etc/sudoers, or (b) create another set of user accounts for them, with a different name but UID = 0 and have them use su to access those accounts.

Creating separate UID 0 accounts has the advantage that the admins can have a separate root password, and those passwords can be distinct for the different admins.

  • 3
    Eh, don't go creating multiple users with UID zero (or users that share UID with any other user). Using sudo is much much cleaner, much less error prone and easier to maintain. The "advantage" that you mention is still the same for sudo accounts. – Kusalananda May 4 '17 at 15:21
  • @Kusalananda, it works just fine, thank you very much. And yeah, ok, sure you could do two accounts with UID > 0, one with sudo access, the other without. As far as I can tell that would be the only way to get sudo to ask for different admin passwords for different users (i.e. two users, four passwords). Though I do suspect it would get confusing in the end. – ilkkachu May 4 '17 at 15:50
1

Log into the machine that needs the accounts. Become the user, root.

sudo -i

After becoming root, add users and set passwords. Create as many users as required.

adduser $username
passwd $username

For each user who should be able to become the root user, add the user to the right sudo group. It's wheel on RHEL.

usermod -aG wheel $username

Make sure your sudo configuration allows the group to become root.

visudo

You'll see two configurations for the wheel group, as follow.

## Allows people in group wheel to run all commands
# %wheel ALL=(ALL) ALL

## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

Uncomment one of the configuration options and save the file. For example, to configure sudo to make each user type their password to become root or to execute command as root, use the following line.

## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL

Now, you have created created m regular users and n privileged users who can become root or execute command as root.

Not the answer you're looking for? Browse other questions tagged or ask your own question.