-2

I want to create a new user and I want this user to be allowed to only run "useradd" and "usermod"

Will I need to configure the sudoers file?

Not sure how to go about this.

1

You can do this with sudo (editing the sudoers file, as you suspected) but really shouldn't.

I'm pretty sure useradd -o -u 0 whatever will happily add you a new root account. Similarly, usermod -o -u 0 whatever will happily make an existing account into a root account. usermod can also change an account's shell (change the sysadmin's shell). Various groups could be interesting too (e.g., is /usr/local/bin writable by the staff group?). /var/spool/cron/* are surely writable by groups like daemon or crontab. Members of group disk often have unrestricted, raw access to the underlying storage devices (e.g., /dev/sda).

Something like find / -perm /020 -not -type l can give you an idea of how many different things are group-writable.

Being able to freely manipulate users is root-equivalent. So you might as well just add the user to the sudo group and let him/her run anything.

You probably have in mind some very limited user manipulation. That can be made secure, e.g., allowing wrapper scripts to be run via sudo. Or by storing users in an alternative store (LDAP, MySQL/PostgreSQL/etc. database, etc.) and then only allowing limited edits there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.