Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root).
For instance, I'd like to allow Tom the DBA to su to the oracle user, but not to the tomcat user or root.

I imagine this could be done with the /etc/sudoers file - is it possible? If so, how?

share|improve this question
up vote 33 down vote accepted

Yes, this is possible.

In /etc/sudoers the item immediately following the equals is the user that the command will be allowed to execute as.

tom  ALL=(oracle) /bin/chown tom *

The user (tom) can type sudo -u oracle /bin/chown tom /home/oracle/oraclefile

share|improve this answer
This would allow Tom to run commands as oracle, but not to actually become the oracle user – gharper Jun 2 '09 at 15:20
What about sudo -u oracle su -? That would give him a shell opened as the oracle user. Is that what you want? – Brent Jun 2 '09 at 15:23
+1 for that last comment, Brent. That would be my answer. – Annika Backstrom Jun 2 '09 at 15:26
Something like the following would work: sudo -u oracle -s or sudo -u oracle -i (-s for shell, -i for login - does a login shell). Unfortunately I don't know offhand what you would use in /etc/sudoers to limit the user, but given that you're allowing them shell access, you probably just want to do tom ALL=(oracle) ALL as someone else mentioned. If they can run a shell, you probably don't care about restriction the commands they can run. – Mark Jun 3 '09 at 1:59
Ideally, would you not want Tom to run commands as the oracle user, instead of becoming the oracle user? The distinction is slight, but it provides a great audit log without having to futz with using an audit shell. – Scott Pack Jun 16 '09 at 21:05

Add to your /etc/sudoers something like

tom ALL=(oracle) ALL

Then user tom should be able to use sudo to run things as user oracle with the -u option, without letting tom

I.e. getting a shell as user oracle (well, given that your sudo is new enough to have the -i option).

sudo -u oracle -i
share|improve this answer
I had to use syntax tom ALL=(oracle)NOPASSWD:ALL to make sudo not to ask password – snowindy Dec 4 '15 at 5:45

To ONLY provide the capabilities in the question, add the following to /etc/sudoers:

tom            ALL=(oracle)    /bin/bash

Then tom can:

sudo -u oracle bash -i
share|improve this answer

protected by Sven Dec 11 '14 at 22:49

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.