On Aug 22, 2006, at 5:45 PM, Ian Ward Comfort wrote:
On Aug 22, 2006, at 2:32 PM, Michael Johnson wrote:
You can also restrict the commands the person can run by doing
something like:
Cmnd_Alias SUPPORT = /usr/bin/less, /bin/more, /bin/chmod, /bin/
chown, /bin/cat
and then:
username ALL=(root) NOPASSWD: SUPPORT
This gives the person rights to run the listed commands as root,
but nothing else.
Realize that this particular combination gives a malicious user a
root shell if (s)he wants one.
Give anyone the ability to chmod/chown as root, then of course. It
was just an example. You are of course going to be more careful, and
not give any sudo access to anyone you can't trust.
Before we get into some pointless argument about trust, just stop.
That's not the point of the example. It was just that...an example.
-Michael
---------------------------------------
O it is excellent to have a giant's strength; but it is tyrannous To
use it like a giant.
--Shakespeare, Measure for Measure, Act II
