Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How can I allow one user to su to another without allowing root access?

We have a user account that our DBAs use (oracle). I do not want to set a password on this account and want to only allow users in the dba group to su - oracle.

How can I accomplish this?

I was thinking of just giving them sudo access to the su - oracle command. However, I wouldn't be surprised if there was a more polished/elegant/secure way.

share|improve this question

marked as duplicate by Chris S Aug 14 '12 at 12:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Think the answer here would apply:… – James Yale Aug 14 '12 at 11:53
Thanks @JamesYale, different "problem" but seems to answer my question. – Belmin Fernandez Aug 14 '12 at 12:02
up vote 3 down vote accepted

If you are going to give them full access to the user account anyway, why not just let them do whatever they want via sudo directly?

%dba     ALL = (oracle) ALL

This line in sudoers will allow anyone in the dba user group to run any command as the oracle user, including getting a shell with either sudo -su oracle or sudo -iu oracle for a login shell.

Alternatively, if you don't want them to have access to everything, you can substitute the last ALL with a list of commands to limit them to, eg.

%dba     ALL = (oracle) /bin/chmod, /usr/local/bin/oracleclient localhost
share|improve this answer

Yes, there is. Use

sudo -u oracle -i

and add permissions for nopasswd default shell like:

%dba    ALL=(oracle)NOPASSWD: /bin/bash
share|improve this answer
Out of curiosity, why limit them to a shell? Seems an odd command to pick to limit to since once they have a shell they can run anything anyway. – Matthew Scharley Aug 14 '12 at 11:56
@MatthewScharley limiting to a shell is enough to execute sudo -i. Furthermore, OP asked to limit just to su - oracle. Though you always can replace /bin/bash to ALL. =) – rush Aug 14 '12 at 12:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.