Very Computer

by **Dr. Richard C. Staat** » Tue, 12 Aug 1997 04:00:00

Greetings!

I know there is a way of granting Root like access to programs
to non-root users involving changing the suid's.

Could someone briefly explain this process and the
advantages and disadvantages.

Thank you in advance,

Rich

by **Thomas Griffin** » Tue, 12 Aug 1997 04:00:00

--------------150FE5A9D69802819A181017
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Quote:> I know there is a way of granting Root like access to programs
> to non-root users involving changing the suid's.

> Could someone briefly explain this process and the
> advantages and disadvantages.

Check out the "Sudo Home Page":

http://www.courtesan.com/courtesan/products/sudo/sudo.html

It has lots of the kind of information you're looking

for ... and a free program that works well.

+--------------------------+----------------+--------------------------+
| Thomas L. Griffing | |~~\ /~~\ ~|~ | Dallas Softworks, Inc. |
| Perl Hacker, Linux Bigot | | | `--. | | "making technology work" |

--------------150FE5A9D69802819A181017
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<HTML>

<BLOCKQUOTE TYPE=CITE>I know there is a way of granting Root like access
to programs
<BR>to non-root users involving changing the suid's.

<P>Could someone briefly explain this process and the
<BR>advantages and disadvantages.</BLOCKQUOTE>
Check out the "Sudo Home Page":
<PRE>    <A HREF="http://www.courtesan.com/courtesan/products/sudo/sudo.html">http://www.courtesan.com/courtesan/products/sudo/sudo.html</A></PRE>

<PRE>It has lots of the kind of information you're looking</PRE>

<PRE>for ... and a free program that works well.</PRE>

<PRE>
+--------------------------+----------------+--------------------------+
| Thomas L. Griffing       | |~~\  /~~\ ~|~ | Dallas Softworks, Inc.   |
| Perl Hacker, Linux Bigot | |   | `--.  |  | "making technology work" |

 </HTML>

--------------150FE5A9D69802819A181017--

by **Chris Raymon** » Wed, 13 Aug 1997 04:00:00

Hi Richard,

What you do is create an execuatable file, owned by root, that does
what you want to grant your users access to. Then, assuming your
file is named "/usr/local/bin/foo", give the command

chmod 4755 /usr/local/bin/foo

and you're done.

Advantages:

Only one. It lets the users do things for themselves instead of bugging
the sysadmin. This can be a big advantage, though.

Disadvantages:

Legion.

(A) Can you trust your users not to*up, or misuse the command?
For examplee, if you let them mess about with the printer queues
all of them will try to boost their own jobs to the top of the
queue, kill the queue and restart, etc. This is a mild example.

(B) The executable better be a Perl script with all variables very
carefully untainted, or a C program with fiendish attention
paid to all programming details. Else, you have probably
created an easy way for one of the many system breakers out
there to break into your system. Every UNIX security book,
reference, etc., implores you not to write SUID-root shell
scripts in particular, since by causing the script to fail,
a knowledgable system breaker can get a root shell. Same
principles apply for C programs or Perl scripts--if you don't
program with great care and attention to details, you could
still be granting unwanted access.

(C) There are solutions out there that are a trifle more secure.
One free solution that comes to mind is installing "sudo",
a Linux package ported to Solaris that allows the flexible
granting of privileges to ordinary users. It's not perfect,
but it probably does a better security job than 99.5% of
Solaris sysadmins could do on their own.

I hope this causes you to think long, hard and carefully about your
question. AND DON'T TRY TELLING ME YOUR SITE DOESN'T NEED SECURITY.
If nothing else, it will help protect your time and your users' time.
What if some system breaker hacks your system and then proceeds to
pirate bank accounts with it? Do you REALLY want to be telling
professionally suspicious types like the FBI, "Well, gee, I had no
idea my computer was being used to steal $5,000,000..."

Okay, I know you probably think I've gone too far in my advice. But
I really think you should think it over VERY carefully.

Good luck,
Chris Raymond

Quote:> Greetings!

> I know there is a way of granting Root like access to programs
> to non-root users involving changing the suid's.

> Could someone briefly explain this process and the
> advantages and disadvantages.

> Thank you in advance,

> Rich

by **Vivek Khindr** » Thu, 14 Aug 1997 04:00:00

You may want to source a package called "sudo". This package lets
you configure on a username,host and command basis who can run what as
root. This package is on all of the SunSites. It works. The only
caution I will say is take care in what applications you give root
access to.

Vivek Khindria

[Greetings!

[I know there is a way of granting Root like access to programs
[to non-root users involving changing the suid's.

[Could someone briefly explain this process and the
[advantages and disadvantages.

[Thank you in advance,

[Rich

Very Computer

Root Access to non-root users

Root Access to non-root users

Root Access to non-root users

Root Access to non-root users

Root Access to non-root users