Can someone suggest how can I change process privileges in Linux to root ?

Assume, I have a normal process running under some user-consider me. Now my script should create some users using 'useradd' command and I want to disable the user accounts after few hours. Let us take time frame of 5 hours. Every 5 hours it should enable the account and after 5 more hours it should disable the account.

Now the problem is from the script if I try to gain root access only via typing 'su' command it asks for prompt. Well, my intention here is to invoke this script from remote client (probably via web service either in .net or in Java).

So Is there a way I can change to root mode and create/enable/disable the accounts in Linux without giving any prompt (where it need to wait for someone's input)? Assume I have a root password.

I did try with pipe command as below:

echo "password" | su

But somehow it brings me on the prompt. If I am successful to run a script directly without prompt, I can proceed with doing same thing via web service.

closed as unclear what you're asking by msw, slm, Anthon, Renan, rahmu Sep 25 '13 at 17:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Your question tells us half the solution that you've invented but doesn't tell us what problem you are trying to solve. There is probably a much better way to achieve your goal, but creating time-limited root accounts on the fly is not the way. – msw Sep 25 '13 at 15:52

Probabely you familar with sudo command, and /etc/suoders file if you want write same thing you can read its code.

  • Thanks for you input. But what if i am not supposed to use sudo command? I Have a situation where I cannot use sudo command.. – atp9 Sep 26 '13 at 5:40
  • That works on Linux. I have a one more server where i am supposed to do the same and its AIX server. Is there a way I can achieve same thing. well I did try with sudo but looks like that is not working with AIX. it says there is no command such as sudo. – atp9 Sep 26 '13 at 5:49
  • I know BSD family have sudo command, may be AIX has sudo command. – PersianGulf Sep 26 '13 at 6:25
  • okay.. Let me search on that. – atp9 Sep 26 '13 at 11:43
  • i realize that having sudo on AIX will open security holes for the users who have little bit of knowledge on unix/linux/Aix commands and anyone can play around. My intention is to have root access to only one user (non-root) account for specific time. That is why i am trying to get rid of su command prompt because i have root password. – atp9 Sep 30 '13 at 6:35

As msv pointed out in the comments, the whole premiss sounds like an instance of the of the XY problem and very much a nightmare security wise, but I'll try to address the question of gaining root privileges without a password.

First off echo "password" | su won't work because su does not read the password from stdin, but opens /dev/tty directly for reading. While there are tools (such as expect) which can be used to automate interactive programs, the approach of automatically gaining a root shell in order to invoke a specific command as root is a bad from a security perspective as it violates the principle of least privilege.

That said, authentication with su could be automated with expect using something like the following:

#!/usr/bin/expect -f
spawn su
expect "Password:"
send "password\n";

If the goal is to allow the invocation of a specific command as root, without requiring the root credentials, the right tool for the job is sudo. For instance, if it desired to allow users in the wheel group to a run useradd without entering a password, it can be achieved by adding the following stanza to /etc/sudoers with the sudoedit command:

%wheel    ALL = NOPASSWD: /usr/sbin/useradd

When setting up such privileges, it is prudent to atleast make sure that the capability is restricted to a particular user or an exclusive group.

As for using this method for adding users via a CGI-script or similar, typically it would not be desirable to grant such privileges directly to web-facing software, but to add a level of privilege separation in between. The actual privileges could be granted to a separate software component, such as a daemon, which the web-application would ask (via IPC) to perform the privileged operation on its behalf. This way input validation could be done both by the privileged process and the web-application, to minimize the risks of exploitable flaws in the web-application allowing the invocation of the privileged operation (useradd in this case) with arbitrary parameters, or worse, such as the execution of arbitrary code with elevated privileges.

  • Thanks for your input and explanation. One thing I learned is when we type 'su' it tries to read from /dev/tty. So any possibility we can write directly to that terminal and skip the prompt? Again, this is what i think, I may be wrong as I have very less knowledge of terminals. Well i may sound bit adamant related to the thing i want to achieve(skipping the prompt) but i really want to skip that prompt. – atp9 Sep 26 '13 at 6:28
  • Tools like expect are what you need to, in essence, write to /dev/tty. Apart from the command line tool there are also libraries available for Perl and Python. – Thomas Nyman Sep 26 '13 at 6:40

I know of two tools that were designed for situations like this: Expect and Empty. They both wait for a program to listen on standard input, then feed it a predetermined value. Expect is based on TCL and has a relatively large user base. Empty has fewer dependencies but might have less support. There should be enough documentation on each one's page to solve this simple problem.



Not the answer you're looking for? Browse other questions tagged or ask your own question.