Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hy, a friend and me want to share a Linux-Machine. We both need to get root-rights via sudo for administering that machine. Is it somehow possible to deny the access to the home-folder for the other one, although he can become root?

Thanks!

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Only with something like SELinux.

share|improve this answer
    
...and what user account has the right to modify the SELinux rule set? –  andol May 16 '10 at 22:41
    
A root account with the appropriate role. Simply make it impossible for <friend> to acquire that role. –  Ignacio Vazquez-Abrams May 16 '10 at 22:50
add comment

You could install encrypted home directories. This page has a writeup on how to install under Ubuntu.

share|improve this answer
3  
This only protects the data from being mounted for reading. If the encrypted volume is mounted and both users have root access, they can both read the files within. –  obfuscurity May 17 '10 at 0:23
add comment

you could restrict/deny access to /bin/su and other methods of obtaining 'full' root access on the machine. also, you can restrict /what/ can be run with root privileges, for certain users in /etc/sudoers and enable full logging of things executed with sudo

example:

Defaults        logfile=/var/log/sudolog
userA     ALL = (root) /bin/ls, \
                       /usr/bin/apt-get update,  \
                       /usr/bin/vim /etc/*, \
                       !/usr/bin/su *root*

and so on. you can provide the exact commands you want your friend to be able to use, including the command line parameters, if you want to lock it down further (like with apt-get in my example)

you basically need to figure out /what/ he needs root access for, and dole it out sparingly. or learn to trust him.

two additional examples; vim /etc/* allows the user to edit anything in /etc/ as root, and the last one denies access to su (just as an example, since no access to su is implied, anyhow.

http://linux.die.net/man/5/sudoers , the man 5 sudoers in web form, has lots of examples to pick over.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.