0

Can someone suggest how can I change process privileges in Linux to root ?

Assume, I have a normal process running under some user-consider me. Now my script should create some users using 'useradd' command and I want to disable the user accounts after few hours. Let us take time frame of 5 hours. Every 5 hours it should enable the account and after 5 more hours it should disable the account.

Now the problem is from the script if I try to gain root access only via typing 'su' command it asks for prompt. Well, my intention here is to invoke this script from remote client (probably via web service either in .net or in Java).

So Is there a way I can change to root mode and create/enable/disable the accounts in Linux without giving any prompt (where it need to wait for someone's input)? Assume I have a root password.

I did try with pipe command as below:

echo "password" | su

But somehow it brings me on the prompt. If I am successful to run a script directly without prompt, I can proceed with doing same thing via web service.

1
  • Your question tells us half the solution that you've invented but doesn't tell us what problem you are trying to solve. There is probably a much better way to achieve your goal, but creating time-limited root accounts on the fly is not the way.
    – msw
    Sep 25, 2013 at 15:52

3 Answers 3

2

Probabely you familar with sudo command, and /etc/suoders file if you want write same thing you can read its code.

5
  • Thanks for you input. But what if i am not supposed to use sudo command? I Have a situation where I cannot use sudo command..
    – atp9
    Sep 26, 2013 at 5:40
  • That works on Linux. I have a one more server where i am supposed to do the same and its AIX server. Is there a way I can achieve same thing. well I did try with sudo but looks like that is not working with AIX. it says there is no command such as sudo.
    – atp9
    Sep 26, 2013 at 5:49
  • I know BSD family have sudo command, may be AIX has sudo command. Sep 26, 2013 at 6:25
  • okay.. Let me search on that.
    – atp9
    Sep 26, 2013 at 11:43
  • i realize that having sudo on AIX will open security holes for the users who have little bit of knowledge on unix/linux/Aix commands and anyone can play around. My intention is to have root access to only one user (non-root) account for specific time. That is why i am trying to get rid of su command prompt because i have root password.
    – atp9
    Sep 30, 2013 at 6:35
2

As msv pointed out in the comments, the whole premiss sounds like an instance of the of the XY problem and very much a nightmare security wise, but I'll try to address the question of gaining root privileges without a password.

First off echo "password" | su won't work because su does not read the password from stdin, but opens /dev/tty directly for reading. While there are tools (such as expect) which can be used to automate interactive programs, the approach of automatically gaining a root shell in order to invoke a specific command as root is a bad from a security perspective as it violates the principle of least privilege.

That said, authentication with su could be automated with expect using something like the following:

#!/usr/bin/expect -f
spawn su
expect "Password:"
send "password\n";
interact

If the goal is to allow the invocation of a specific command as root, without requiring the root credentials, the right tool for the job is sudo. For instance, if it desired to allow users in the wheel group to a run useradd without entering a password, it can be achieved by adding the following stanza to /etc/sudoers with the sudoedit command:

%wheel    ALL = NOPASSWD: /usr/sbin/useradd

When setting up such privileges, it is prudent to atleast make sure that the capability is restricted to a particular user or an exclusive group.

As for using this method for adding users via a CGI-script or similar, typically it would not be desirable to grant such privileges directly to web-facing software, but to add a level of privilege separation in between. The actual privileges could be granted to a separate software component, such as a daemon, which the web-application would ask (via IPC) to perform the privileged operation on its behalf. This way input validation could be done both by the privileged process and the web-application, to minimize the risks of exploitable flaws in the web-application allowing the invocation of the privileged operation (useradd in this case) with arbitrary parameters, or worse, such as the execution of arbitrary code with elevated privileges.

2
  • Thanks for your input and explanation. One thing I learned is when we type 'su' it tries to read from /dev/tty. So any possibility we can write directly to that terminal and skip the prompt? Again, this is what i think, I may be wrong as I have very less knowledge of terminals. Well i may sound bit adamant related to the thing i want to achieve(skipping the prompt) but i really want to skip that prompt.
    – atp9
    Sep 26, 2013 at 6:28
  • Tools like expect are what you need to, in essence, write to /dev/tty. Apart from the command line tool there are also libraries available for Perl and Python. Sep 26, 2013 at 6:40
1

I know of two tools that were designed for situations like this: Expect and Empty. They both wait for a program to listen on standard input, then feed it a predetermined value. Expect is based on TCL and has a relatively large user base. Empty has fewer dependencies but might have less support. There should be enough documentation on each one's page to solve this simple problem.

http://expect.sourceforge.net/

http://empty.sourceforge.net/

Not the answer you're looking for? Browse other questions tagged or ask your own question.