Improve company productivity with a Business Account.Sign Up

x
?
Solved

sudo su [-] <list of users>

Posted on 2010-09-04
4
Medium Priority
?
799 Views
Last Modified: 2013-12-16
I want a good syntax for allowing one group of users to be able to access a list of functional accounts using sudo.  I wrote something like

User_Alias ADMIN = a, b, c
ADMIN  ALL = (ALL) /bin/su - functional1, /bin/su - functional2, ...

I want something more elegant with '-' after su to be optional
0
Comment
Question by:farzanj
  • 3
4 Comments
 
LVL 6

Accepted Solution

by:
apresence earned 500 total points
ID: 33605598
Hate to break the bad news, but I don't believe it is possible to do this because the sudoers file uses glob wildcards, not regular expressions.  Globs allow you to do things with allowing one or more of a certain character, etc, but do not allow you to provide alternate strings as options.  Unfortunately, if it supported regular expressions, then this would be trivial to do.

More info here:
http://www.sudo.ws/sudo/sudoers.man.html
http://jamesthornton.com/linux/man/glob.7.html

Alternatively, you could write a script that expands a list of users into the required syntax and updates the sudoers file
0
 
LVL 6

Assisted Solution

by:apresence
apresence earned 500 total points
ID: 33605619
Another (possibly more elegant) way to do this is allow the users to run a script using sudo.  Save the attached code into /bin/su-wrap and chmod it to 700.

Your sudoers file then becomes just this:
User_Alias ADMIN = a, b, c
ADMIN ALL = (ALL) /bin/su-wrap

In my case, I'm using foo1 and foo2 as "ADMIN" users, and allowing either of them to switch to the other.  You can change the 2nd lline of the su-wrap script to list whatever users you want your admins to be able to su over to.  Using your example, you'd put:
ALLOWED_USERS="functional1 functional2".

Testing:
foo1@npx1600734:~ $ sudo su-wrap - foo2
Password:
Executing: /bin/su - foo2
foo2@npx1600734:~ $ exit
foo1@npx1600734:~ $ sudo su-wrap foo2
Executing: /bin/su foo2
foo2@npx1600734:~ $
#!/bin/sh
ALLOWED_USERS="foo1 foo2"
USING_ENV=0
if [ "$1" = "-" ]; then
  USING_ENV=1
  shift
fi
if [ $# -ne 1 ]; then
  echo "Usage: su-wrap [-] username" >&2
  exit 1
fi
for i in $ALLOWED_USERS; do
  if [ $1 = $i ]; then
    if [ $USING_ENV -eq 1 ]; then
      CMD="/bin/su - $i"
    else
      CMD="/bin/su $i"
    fi
    echo "Executing: $CMD"
    $CMD
    break
  fi
done

Open in new window

0
 
LVL 6

Assisted Solution

by:apresence
apresence earned 500 total points
ID: 33605623
Two follow-up notes:
1. Make sure the /bin/su-wrap script is owned by root:root.
2. Remove the trailing "." from this line:
ALLOWED_USERS="functional1 functional2".
so it becomes:
ALLOWED_USERS="functional1 functional2"

Hope it works!
0
 
LVL 31

Author Closing Comment

by:farzanj
ID: 33605994
I think you are right.  Kindly explain one more time why something like

/bin/su [ -] user   (notice a space)
OR
/bin/su ? user

doesn't work.  In the first one I tried to give an option between a space and -.  In the second, I tried to use any character, hoping it would allow either a space or a hyphen.  May be I am thinking too much like regular expressions.
0

Featured Post

Build your data science skills into a career

Are you ready to take your data science career to the next step, or break into data science? With Springboard’s Data Science Career Track, you’ll master data science topics, have personalized career guidance, weekly calls with a data science expert, and a job guarantee.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension . This reminded me of questions that come up here at EE along the lines of, "How can I tell the type of file from its cont…
Often times it's very very easy to extend a volume on a Linux instance in AWS, but impossible to shrink it. I wanted to contribute to the experts-exchange community a way of providing a procedure that works on an AWS instance. It can also be used on…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

595 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question