Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How can I allow one user to su to another without allowing root access?

We have a user account that our DBAs use (oracle). I do not want to set a password on this account and want to only allow users in the dba group to su - oracle.

How can I accomplish this?

I was thinking of just giving them sudo access to the su - oracle command. However, I wouldn't be surprised if there was a more polished/elegant/secure way.

share|improve this question
    
Think the answer here would apply: serverfault.com/questions/17814/… –  James Yale Aug 14 '12 at 11:53
    
Thanks @JamesYale, different "problem" but seems to answer my question. –  Beaming Mel-Bin Aug 14 '12 at 12:02
add comment

marked as duplicate by Chris S Aug 14 '12 at 12:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers

If you are going to give them full access to the user account anyway, why not just let them do whatever they want via sudo directly?

%dba     ALL = (oracle) ALL

This line in sudoers will allow anyone in the dba user group to run any command as the oracle user, including getting a shell with either sudo -su oracle or sudo -iu oracle for a login shell.

Alternatively, if you don't want them to have access to everything, you can substitute the last ALL with a list of commands to limit them to, eg.

%dba     ALL = (oracle) /bin/chmod, /usr/local/bin/oracleclient localhost
share|improve this answer
add comment

Yes, there is. Use

sudo -u oracle -i

and add permissions for nopasswd default shell like:

%dba    ALL=(oracle)NOPASSWD: /bin/bash
share|improve this answer
1  
Out of curiosity, why limit them to a shell? Seems an odd command to pick to limit to since once they have a shell they can run anything anyway. –  Matthew Scharley Aug 14 '12 at 11:56
    
@MatthewScharley limiting to a shell is enough to execute sudo -i. Furthermore, OP asked to limit just to su - oracle. Though you always can replace /bin/bash to ALL. =) –  rush Aug 14 '12 at 12:08
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.