Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was just wondering if there is a way to give a user root access escalation on a *nix system, kind of like sudo, but which requires more than one sysadmin authorisation. I am thinking of something sort of like how a self-destruct command on a starship requires multiple command-level authorisations.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Maybe you could abuse a securid token by setting up the root account with the token. Then give the token to the "partially trusted person number 1 (manager)" and the PIN to "partially trusted person number 2 (admin)". Partially trusted person number 2 has to phone trusted person number 1. and ask him the number on the display of the token. That way 1 and 2 have to come together to make it possible to log in. I'd be a bit wary of relying on it, though you could put 2 locks on the door of an office and issue the keys to the semi-trusted parties who would again need to come together to open the office to get at the secure workstation?

I wouldn't be surprised if there are bits bolted onto some operating systems that do this but you'll probably have to join an organisation where you are expected to salute and say "Sir" a lot before you can use them.

This blog entry by someone who designed/built just such a system is interesting: Dr Rick (Crypto)Smith Blog

share|improve this answer
add comment

There's nothing like this, by default, but SELinux and and Posix ACLs might be able to be leveraged by denying everyone root except in cases where multiple tokens (or files, or processes, or whatever) exist and are owned by the proper people. Sort of like an even more complicated use of semaphores.

Check out this article in Linux Journal about making root unprivileged.

BTW, in case you didn't know, you're meddling in Deep Magic.

share|improve this answer
2  
deep, deep bayou voodoo magic. there is a man with a skull and tooth necklace standing over you as you attempt to continue... :) –  troyengel Jan 1 '10 at 17:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.