Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

which is the best way to allow a new user that I just created on ubuntu linux 9.04 to execute a script that requires some sudo without allowing him to the sudoers?

The fact is that I want to give the user just the ability to execute that script, without letting him to do anything more.

Is there a simple way to do it?

share|improve this question
    
Did you mean that you want them to be able to execute the script as root? –  Ignacio Vazquez-Abrams May 8 '10 at 15:39
    
Yes, it should because it involves many sudo commands. But without allowing more than this.. –  Jack May 8 '10 at 15:42
    
If you run a script with sudo, you won't need to call sudo from inside the script, as it already runs with root rights. –  SvW May 8 '10 at 15:51

4 Answers 4

up vote 2 down vote accepted

If the script really needs root rights, you could limit his sudo capabilities to just that script (see man sudoers). If this is required for more than one user, create a group for this purpose, and if they should be allowed to execute this only once, modify the script so that it removes the user from the group afterwards.

Also, make extra sure your script is safe, especially if it uses parameters.

share|improve this answer

If it's going to be more fluid (ie. you may add other scripts later, or you may want to add/remove many users' rights to execute the file), you could create a group, add the user to the group, set the group ownership of the file to that group, and then add group execute rights.

share|improve this answer

Lshell is the solution. You can restrict any commands to your users. Combined with sudo and MySecureShell gives you a powerfull solution.

http://lshell.ghantoos.org/

share|improve this answer

You cann add the suid bit to your shellscript. So if your shellscript is owned by root you do

sudo chown root:root someScript
sudo chmod u+s someScript

This will do it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.