Home / server / Questions / 321015
Accepted
dtech
Asked: 2011-10-13 15:57:26 +0800 CST

Multiple access level modes for accounts on linux servers

  • 772

When currently working on a linux server (I sysadmin 2) I have the 3 following use-cases:

  1. End-user use (e.g. personal or normal project groups)
  2. User problem solving and low-risk changes (e.g. Apache vhost changes)
  3. Real sysadmin work (e.g. configurig daemons)

We have 1 user account for everything (which is configured with detailed and correct groups for almost everything) in the NIS and generally it goes well.

The problem is that we currently open a root shell (sudo -i) for 2 & 3. This introduces risk because of full-access. Also we encounter errors from people with root access who overestimate their abilities (non-profit organisation so it's generally meant well).

I'd like to separate 2 & 3 by granting groups rights correctly (e.g. site team full access to apache but nothing else). Problem is I also don't want to grant the user accounts rights , i'd like to them to enter "admin mode" like is done now because it's easily loggable and makes people realise that they can cause damage now.

Is it possible to create multiple levels of power instead of just the normal user/root differentiation?

Other suggestions are ofcourse also welcome

linux sudo user-permissions

2 Answers

  1. Best Answer

    You can use su to force people to change to an elevated user when doing things in category two.

    Each user would have two accounts: $normal_account and $admin_account. Assign the needed permissions to $admin_account the the person can just do su $admin_account - to gain access to that account and do their admin work.

    For class 3 functions I would say don't add another account just stop shelling out. Run your admin commands directly with sudo <command>. If you want to be really careful turn off password caching in the sudoers file.

    • 2

  2. You have two options, the most complex but most secure is mandatory access control (MAC) which can be accomplished via SELinux. The second is to configure your /etc/sudoers to grant a subset of control.

     User_Alias     OPERATORS = bob, tippy, george
 Runas_Alias    OP = root, operator
 Host_Alias     OFNET = 10.1.2.0/255.255.255.0
 Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm

OPERATORS ALL=ALL

# The users in the OPERATORS group can run any command from
 any terminal.

linus ALL=(OP) ALL

# The user linus can run any command from any terminal as any 
user in the OP group (root or operator).

user2 OFNET=(ALL) ALL

# user user2 may run any command from any machine in the 
OFNET network, as any user.

user3 ALL= PRINTING

# user user3 may run lpc and lprm from any machine.

bob ALL=(ALL) ALL

    You can find more detail information at the Sudoers Manual

    • 1