up vote 11 down vote favorite
1
share [g+] share [fb]

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root).
For instance, I'd like to allow Tom the DBA to su to the oracle user, but not to the tomcat user or root.

I imagine this could be done with the /etc/sudoers file - is it possible? If so, how?

link|improve this question
100% accept rate
feedback

5 Answers

up vote 17 down vote accepted

Yes, this is possible.

In /etc/sudoers the item immediately following the equals is the user that the command will be allowed to execute as.

tom  ALL=(oracle) /bin/chown tom *

The user (tom) can type sudo -u oracle /bin/chown tom /home/oracle/oraclefile

link|improve this answer
1  
This would allow Tom to run commands as oracle, but not to actually become the oracle user – gharper Jun 2 '09 at 15:20
4  
What about sudo -u oracle su -? That would give him a shell opened as the oracle user. Is that what you want? – Brent Jun 2 '09 at 15:23
+1 for that last comment, Brent. That would be my answer. – Adam Backstrom Jun 2 '09 at 15:26
Yup that'll work! – gharper Jun 2 '09 at 15:30
1  
Something like the following would work: sudo -u oracle -s or sudo -u oracle -i (-s for shell, -i for login - does a login shell). Unfortunately I don't know offhand what you would use in /etc/sudoers to limit the user, but given that you're allowing them shell access, you probably just want to do tom ALL=(oracle) ALL as someone else mentioned. If they can run a shell, you probably don't care about restriction the commands they can run. – Mark Jun 3 '09 at 1:59
show 1 more comment
feedback
up vote 10 down vote

Add to your /etc/sudoers something like

tom ALL=(oracle) ALL

Then user tom should be able to use sudo to run things as user oracle with the -u option, without letting tom

I.e. getting a shell as user oracle (well, given that your sudo is new enough to have the -i option).

sudo -u oracle -i
link|improve this answer
feedback
up vote 3 down vote

I think using ssh to localhost using key only authentication is the simplest way. I believe su will only not ask for the password if UID = 0 .

link|improve this answer
feedback
up vote 2 down vote

I don't understand why people insist on this 'sudo su' stuff. If you want to become a certain user with a shell, all you need is 'sudo -u oracle -i', that's all.

If you want to become a full root user with a shell, then 'sudo -i' works just fine, why 'sudo su -'? It puts 2 superuser related commands right next to each other for no reason.

link|improve this answer
I'm not sure if RHEL uses an older version of sudo, or if that option isn't enabled, but there is no "sudo -i" available on these systems (RHEL 4 & 5) – gharper Jun 2 '09 at 18:27
Correction - it doesn't exist on the RHEL 4 boxes (sudo v1.6.7p5), but it is possible on RHEL 5 (sudo v1.6.8p12) – gharper Jun 2 '09 at 18:30
feedback
up vote 0 down vote

Using SU will require the password for the account being changed to. If this user does not have the root or tomcat password, they cannot change to that user.

link|improve this answer
I think I may have worded my question poorly... currently, we have a very few specific users who are allowed to run "sudo su" including a DBA, but all he needs is to get to the oracle user. If there was a way to allow the DBA to become the oracle user & only have to remember his own password (oracle passwords are different for each platform on our systems), then that would be ideal. – gharper Jun 2 '09 at 15:24
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.