4

we have a group called JBossAdmins and users of this group must edit some /etc files on a RHEL 6:

  • /etc/httpd/*
  • /etc/java/*
  • /etc/jboss/*

my first idea was to give the following sudo permissions:

%JBossAdmins ALL=(root) /bin/vi /etc/httpd/*
%JBossAdmins ALL=(root) /bin/vi /etc/java/*
%JBossAdmins ALL=(root) /bin/vi /etc/jboss/*

Obviously, the users can now start the vi as root and then edit any file by executing f.e. :e /etc/passwd

So sudo is not a good idea.

Then it came into my mind to do a chgrp JBossAdmins -R path and then a chmod g+rw -R path.

But i'm not quite sure whether this is a good idea either.

So considering the security implications, what's the best practice allowing a group of users to edit some /etc file? Are there any better alternatives than sudo or chgrp/chmod?

2 Answers 2

5

Giving someone sudo in vi is always a bad idea. They can get out of vi with a root-shell by issuing the :shell command. You don't want that.

An alternative for you might be sudoedit. You can then give your users/groups rights for sudoedit in the sudoers-file:

%JBossAdmins <hostname>: sudoedit /etc/httpd/*
%JBossAdmins <hostname>: sudoedit /etc/java/*
%JBossAdmins <hostname>: sudoedit /etc/jboss/*
1
  • 1
    wow... that's what i'm looking for! :-)
    – JMW
    Feb 10, 2012 at 11:06
4

You could use acls instead and do something like

    setfacl -m g:JBossAdmins:rw /path/to/file

which would grant r/w permission to anyone in the JBossAdmins group to the specific files.

3
  • This is exactly what you should do. Using sudo is a clunky solution. How about if they use a different editor? Or if the want to use less or cat Feb 10, 2012 at 15:05
  • Why is it better to use ACLs in this case than conventional groups, as OP suggested with chgrp? Isn't this exactly why group permissions exist? Nov 28, 2023 at 4:31
  • Per OP, the files are in /etc. Files/directories in /etc/ have user/group ownership that shouldn't be changed.
    – Migs
    Mar 2 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .