-3

First of all im not a trained linux personnel, i am required to audit . I need assistance to understand the below scenario.

etc/group root:x:0:root,syed

etc/passwd syed:x:613:100::/home/syed:/bin/bash

My quest : Is syed has the root priviledge since UID not 0? If yes, can i differentiate the activity done by syed and root or i can only see as a root activities ? cnt differentiate.

Thanks for the assistance.

2

No, Syed is not 'root'. He belongs to the groups with ids 0 and 100. A program like 'sudo' might be configured to allow users in group 0 to execute commands via it without a password but in the Unix kernel (ignoring capabilities) the extra abilities are all associated with user id 0, not group id 0.

  • So is that mean being in the GID 0 doesnt bring any privilege capabilities as root unless the UID 0? – Ash Jul 27 '17 at 6:47
  • 1
    some files, directories, device nodes, etc are readable and/or writable members of group 0, so any member of that group (including syed, above) would be able to read from or write to them. – cas Jul 27 '17 at 8:05
0

He has a different UID, but he is a member of the root group, so when group permissions come into play then the syed user would indeed have the same permissions as root.

Each user should have their own .bash_history, etc. so you should see separate lists of commands, etc. if that is what your audit tools depend on.

A better way if auditing is required is to set up sudo and require its use, since it logs use with the command, who ran it, the working directory, etc.

  • is it acceptable to have more user in GID =0 ? – Ash Jul 27 '17 at 6:45
  • 1
    yes it is both acceptable and normal. – icarus Jul 27 '17 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.