1

Possible Duplicate:
How can I allow one user to su to another without allowing root access?

We have a user account that our DBAs use (oracle). I do not want to set a password on this account and want to only allow users in the dba group to su - oracle.

How can I accomplish this?

I was thinking of just giving them sudo access to the su - oracle command. However, I wouldn't be surprised if there was a more polished/elegant/secure way.

2

2 Answers 2

3

If you are going to give them full access to the user account anyway, why not just let them do whatever they want via sudo directly?

%dba     ALL = (oracle) ALL

This line in sudoers will allow anyone in the dba user group to run any command as the oracle user, including getting a shell with either sudo -su oracle or sudo -iu oracle for a login shell.

Alternatively, if you don't want them to have access to everything, you can substitute the last ALL with a list of commands to limit them to, eg.

%dba     ALL = (oracle) /bin/chmod, /usr/local/bin/oracleclient localhost
2

Yes, there is. Use

sudo -u oracle -i

and add permissions for nopasswd default shell like:

%dba    ALL=(oracle)NOPASSWD: /bin/bash
2
  • 1
    Out of curiosity, why limit them to a shell? Seems an odd command to pick to limit to since once they have a shell they can run anything anyway. Aug 14, 2012 at 11:56
  • @MatthewScharley limiting to a shell is enough to execute sudo -i. Furthermore, OP asked to limit just to su - oracle. Though you always can replace /bin/bash to ALL. =)
    – rush
    Aug 14, 2012 at 12:08

Not the answer you're looking for? Browse other questions tagged .