Allow a user to view the home directory of other users via sudo

Question

I am new to system administration. We have a lab set up where we have a server and client machines. The client machines have LDAP users which has the work area for all the users in the centralized server. So whenever an user logs in, his work area will be mounted through the NFS service in the client machines and all his work will be saved to the server when he logs out.

Now, I want to give a local user in the server limited root access. I want this local user to be able to view the home directory of all the LDAP users and nothing else. I believe I am looking for wheel user in the server. I also believe I should make some changes in the visudo file to allow limited root access to the local user in the server.

user1, %operator ALL= /home/users

I tried adding the above command in the visudo file for the local user user1. I also added the user to the wheel group like below.

usermod -G 10 user1

However, I do not see any changes. Why didn't my approach with sudo work?

Since this approach doesn't seem to be working, I asked: Allow a user to read some other users' home directories

Answer 1

Couple of things:

1. The command sudo is for elevating yourself to a higher level of credentials for either a command or set of commands, not for gaining access to a directory with which you (1) aren't either the owner, (2) in a group that has read permissions to said directory, or (3) the directory doesn't have the other permissions opened to the world.

2. The file /etc/sudoers is the file that contains all the rules for a given system and stipulates which users, groups of users, can run which commands in an elevated way as root, typically, or some other user account. You typically do NOT want to edit this file directly, though you can, it's best not to do so.

3. The command visudo is the prescribed way for editing the /etc/sudoers file.

4. If you want to see what sudo credentials a user has access to, the simplest way is to become that user and run the command, sudo -l.

   $ sudo -l
   Matching Defaults entries for saml on this host:
   env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
   env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
   LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
   
   User saml may run the following commands on this host:
   (ALL) ALL
   (root) NOPASSWD: /usr/lib/jupiter/scripts/bluetooth, (root) /usr/lib/jupiter/scripts/cpu-control, (root) /usr/lib/jupiter/scripts/resolutions, (root)
   /usr/lib/jupiter/scripts/rotate, (root) /usr/lib/jupiter/scripts/touchpad, (root) /usr/lib/jupiter/scripts/vga-out, (root) /usr/lib/jupiter/scripts/wifi
   

wheel access

I believe you're referring to the users' group wheel, which is an old way (to my knowledge) way of granting users permissions to become root via su -. This article does a good job of discussing the use of this group, titled: Administering your Linux system.

Granting access to /home/<user>?

To my knowledge there is no systematic way to do this without giving this user elevated privileges in other ways that you're trying to limit. I would say that if you do not trust this particular user the responsibility of having access in this fashion then they are probably not the right person to be doing this work!

Groups

For example. Say I have 2 students and 1 TA. Students (user1 & user2) TA (user3).

So the groups would be as follows:

• class1
• vboxuser1

So when I logged into the system as any of the above users (1-3), my groups would be as follows:

$ groups
users vboxusers class1

This groups would also need to be set on the student's home dirctories:

$ ls -l /home/user1 | head -3
total 37784
drwxrwxr-x   2 saml class1     4096 May 16 22:02 alsa
drwxrwxr-x  31 saml class1     4096 Mar 26 12:09 apps

This is just one idea, it has issues with this approach, but given the information you've provided is "one way to do it"!

Answer 2

Now, I want to give a local user in the server limited root access.

This sounds like a bad idea.

First, there's the issue of data privacy - if you don't trust this user to have full root permissions, why do you trust him with the data of your users?

Secondly, even if you would somehow manage to grant this user limited root access to /home (which I don't think is possible), there are now several ways for him to gain full root access that you are probably not expecting:

• He can create a symlink to /:

  cd /home
  ln -s / evil-symlink
  

  Now he can access the contents of the root filesystem as /home/evil-symlink/ as root, because it's located inside /home.

• He can create setuid executables inside /home. Just copy /bin/bash to /home/bash, do chmod u+s /home/bash and you have your own root shell.

They only way to limit a user to a certain directory regardless of permissions that I can come up with is chroot, and it's common knowledge that root can break out of a chroot.

Answer 3

First, what you did wrong:

user1, %operator ALL= /home/users

This allows user1 to run any command in the directory /home/users as any user. If there is no executable program in that directory, the rule effectively does nothing. If there are executable programs there, the rule allows user1 to run them.

You cannot use sudo to give users permission to access file, only permission to execute a command as another user.

See Allow a user to read some other users' home directories for a way to do what you're trying to do.