0

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to have root privileges but must be restricted from a single log file such that s/he should not be able to change/delete/write that specific file.

0

Yes you can restrict a sudo user to restrict to run some specific root user commands. so that he/she can execute the configured permission as shown below.

Example : You can give the required permissions in vi /etc/sudoers or type visudo

Add below types of required permissions in /etc/sudoers file.

User_A_permissions:

Cmnd_Alias PERMISSIONS = /usr/sbin/lsof, /usr/bin/ssh, /usr/bin/scp, /usr/bin/rsync, /usr/bin/telnet, /usr/bin/traceroute, /usr/bin/kill, /usr/bin/ps, /usr/bin/netstat, /usr/bin/grep, /usr/bin/crontab, /usr/sbin/tcpdump, /bin/ping, /usr/bin/crontab -u root -l, /usr/bin/crontab -u root -e, /etc/init.d/crond reload, /usr/bin/updatedb, /bin/df, /usr/bin/du, /usr/bin/locate, /usr/bin/find, /bin/su

After that add below line

%User_A_permissions          ALL=PERMISSIONS
  • I think you are restricting the rm command with root privileges altogether. I need this user to be able to delete files with root privileges but not the log file. – E.Bülbül Jan 24 '18 at 13:01
  • In above example, I have given sample commands so that sudo user can use it. You can add /bin/rm then sudo user can delete it. – bala4rtraining Jan 24 '18 at 13:14
  • If you want to restrict a particular log file then give the below line in /etc/sudoers file username ALL = /usr/bin/vi !/var/log/messages, /usr/bin/vi !/etc/group, /usr/bin/vi !/etc/fstab – bala4rtraining Jan 24 '18 at 13:15
  • @bala4rtraining With scp, rsync, or su privileges in the command list I would be able to read/write/delete the log file. I don't think you can restrict sudo the way the OP is asking. – doneal24 Jan 24 '18 at 16:30
1

If you can't limit the sudo for the user, then you can sync logs to different node (rsync/rsyslog).

3

First, you can make the log file unwritable by the root via the sudoers file:

user ALL=(ALL) !/var/log/logfile

That will make it so that the logfile can't be modified, moved, or deleted by the root.

Then you can edit the sudoers file so that the user can only use the commands which you've decided are necessary:

user ALL=(ALL) /bin/command1 /bin/command2 /bin/command3

user ALL=(ALL) !ALL

That will disallow any commands that you don't want the user to have. You can also make the sudoers file immutable via chattr +i /etc/sudoers so that the user can't modify it as root to allow himself to access the log file.

1

A user that is given superuser permissions on a system needs to be

  1. Fully trusted, and
  2. Accountable.

If that's not the case, then the operations that the user needs to undertake as root should be narrowly specified in such a way that they may be listed in the sudoers file in a precise manner (e.g. only be able to run rm on these files). Such a user should also not be able to use sudo to gain a root shell environment.

If this is not possible, then consider setting up a separate non-root account under which all needed operations may be performed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.