I want to create a new user and I want this user to be allowed to only run "useradd" and "usermod"
Will I need to configure the sudoers file?
Not sure how to go about this.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You can do this with sudo (editing the sudoers file, as you suspected) but really shouldn't.
I'm pretty sure
useradd -o -u 0 whatever will happily add you a new root account. Similarly,
usermod -o -u 0 whatever will happily make an existing account into a root account.
usermod can also change an account's shell (change the sysadmin's shell). Various groups could be interesting too (e.g., is
/usr/local/bin writable by the
/var/spool/cron/* are surely writable by groups like
crontab. Members of group
disk often have unrestricted, raw access to the underlying storage devices (e.g.,
find / -perm /020 -not -type l can give you an idea of how many different things are group-writable.
Being able to freely manipulate users is root-equivalent. So you might as well just add the user to the
sudo group and let him/her run anything.
You probably have in mind some very limited user manipulation. That can be made secure, e.g., allowing wrapper scripts to be run via sudo. Or by storing users in an alternative store (LDAP, MySQL/PostgreSQL/etc. database, etc.) and then only allowing limited edits there.