I have an HP-UX server where I need to create a special user account for an application to interact with, and this account must have full root privileges. Sudo is not an option in this. The only thing I can think of is to assign the account UID 0. Would this work to make the account functionally root? Is there some better way to do this without using sudo?
Creating another account with uid 0 can lead to confusing, possibly broken behavior.
I would be reluctant to run any account that can't be run via
There are any number of ways use
sudo when a system connects to an account such as:
ssh, it is possible to specify a script to run on connect.
- Using the profile to run sudo on starting an interactive session.
- Use a wrapper script to elevate privilege before running the request.
I have run various backup routines that need to root access to access all the files. They all connected with restricted access, usually via a non-root account.
sudo can be configured to run commands without requiring a password. It should be simple to create a wrapper script the elevates to
root access via
sudo and runs the required command.
Programs with the setuid bit set run as the user that owns them. This is generally more secure unless the program allows access to an unrestricted shell.
I would not recommend trying to assign UID 0 to another account. The system needs to have 1 root user.
sudo to run commands without a password is an option (personally, I'm not comfortable with code that must be run as root; but you have it so let's be realistic.) Some caveats for this:
/etc/sudoersfile, make sure the
NOPASSWORDoption is the last line for that user. In reading sudoers the last line will override previous ones.
Specify the absolute path for the director(ies) you need for this user.
Defaults env_resetto reset the environment to default variables.
... ## Defaults env_reset ... ## app_user ALL=NOPASSWORD : /path/to/application, /usr/bin/su - root ...
(Change the path to
su to match your HP-UX location.)
It's been a while since I used HP-UX, so please verify the formatting with what's in your
/etc/sudoers file now.
You cannot assign another account UID 0 without breaking everything.
As is pointed out by Rich Homolka in a comment, there's code in the kernel which explicitly checks for uid 0 when needing to check for the root user, which means that root always has at least uid 0.
Also, I hope that you're not using this server for anything else, because giving an application full root privileges without restricting it via sudo at the bare minimum is very dangerous. Especially an application that is connecting over the network, as you say.