Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we have a group called JBossAdmins and users of this group must edit some /etc files on a RHEL 6:

  • /etc/httpd/*
  • /etc/java/*
  • /etc/jboss/*

my first idea was to give the following sudo permissions:

%JBossAdmins ALL=(root) /bin/vi /etc/httpd/*
%JBossAdmins ALL=(root) /bin/vi /etc/java/*
%JBossAdmins ALL=(root) /bin/vi /etc/jboss/*

Obviously, the users can now start the vi as root and then edit any file by executing f.e. :e /etc/passwd

So sudo is not a good idea.

Then it came into my mind to do a chgrp JBossAdmins -R path and then a chmod g+rw -R path.

But i'm not quite sure whether this is a good idea either.

So considering the security implications, what's the best practice allowing a group of users to edit some /etc file? Are there any better alternatives than sudo or chgrp/chmod?

share|improve this question
up vote 5 down vote accepted

Giving someone sudo in vi is always a bad idea. They can get out of vi with a root-shell by issuing the :shell command. You don't want that.

An alternative for you might be sudoedit. You can then give your users/groups rights for sudoedit in the sudoers-file:

%JBossAdmins <hostname>: sudoedit /etc/httpd/*
%JBossAdmins <hostname>: sudoedit /etc/java/*
%JBossAdmins <hostname>: sudoedit /etc/jboss/*
share|improve this answer
wow... that's what i'm looking for! :-) – JMW Feb 10 '12 at 11:06

You could use acls instead and do something like

    setfacl -m g:JBossAdmins:rw /path/to/file

which would grant r/w permission to anyone in the JBossAdmins group to the specific files.

share|improve this answer
This is exactly what you should do. Using sudo is a clunky solution. How about if they use a different editor? Or if the want to use less or cat – Belmin Fernandez Feb 10 '12 at 15:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.