Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

long history short: - we have a bunch of linux servers.

  • lots of users work with linux Desktops. They use them as testing servers.

  • All the infrastructure has the Authentication services linked by Quest Auth Services againts an AD. This gives us the option of logon scripts, startup scripts, and other things.

  • One interesting option this Quest thing gives us is SUDO management. We can edit sudoers file by GPO politics.

  • Now we are deploying a NAS server from Hitachi with cifs and NFS mapping capabilities.

  • Servers are managed by IT, so nobody can go root except us.

  • Desktop users will also mount the NFS shares so they will be able to work with real data and read their own data from servers.

  • Desktop users can go sudo su.

  • If desktop users go from root to another user, the NFS let them work as they where the other user.

I would like to keep them from swithching users, but only between AD users, they must be able to switch to apache user or postgres user.

I'm missing something or this is going to be tricky?

Can anybody give me a hand on this thinking?

Many thanks.

share|improve this question

I'm not entirely sure that i have the exact problem here, but let me try. Change the /etc/sudoers file to:-

%user ALL=(apache,postgres) ALL

So any member of group user can run anything as apache or postgres users. So the commands

sudo -u apache -i

would change to the person in the user group to apache user. However they wouldn't be able to change to everyone in the active directory domain.

share|improve this answer
sudo su - apache would not work in this case. The users will need to invoke sudo with the -u option to specify the user and the -I option to start a login shell. So, to get a shell as apache: sudo -u apache -i – Jeff Strunk Mar 25 '11 at 12:38
up vote 0 down vote accepted

Decado pointed a nice approach.

But the user will be able to go to root, on grub going to /bin/sh and do whatever they like. So... it's pointless to cut them on the sudoers, the only way is going to the fileshares by cifs. and so we will do.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.