0

I want to create "role" accounts for several admin tasks that don't usually require root permissions. For example, consider a www-admin user maintaining files in /var/www.

It seems to me that this is the easiest way to solve file permission issues: It would make sure that everyone assuming this role creates files with permission/ownership so that everyone else with this role can edit/read, without using a group-writeable access mode.

Users could switch to this role using sudo su www-admin --preserve-environment --shell /bin/bash or a similar command.

There are two issues I am having with this:

  1. Sometimes, the www-admin role needs to perform sudo tasks. But after switching to the role, sudo will ask for the role account's password. I don't want to set that and share it with everyone. Can I instead make sudo ask for the original user's password?

  2. After switching to the role, users may need to use SSH, for example to checkout git repos. But, permissions of the SSH auth socket are (of course) set up in a way that the "role" user ID may not read from it.

I am sure this is a pretty common issue in multi-person admin teams. How do you solve this?

Also, I've noted that the sudo man page says "The invoking user's real (not effective) user ID...". So, if there is a difference between real and effective user ID, does that help here...?

2 Answers 2

0

May be it's better to avoid switching "roles" altogether?

Instead you can use ACLs to ensure some set of shared files can be edited w/o any switching.

Also with ACLs you can enforce that "daemons" would be restricted to have R/O access if needed.

sudo arguably was mostly a way to overcome standard UNIX User/Group/Others access model (and another one that can be described as "root" or "nobody") and meanwhile it's still in wide use, modern UNIX systems have acquired more fine grained access models other that aforementioned one.

0
  1. Sometimes, the www-admin role needs to perform sudo tasks. But after switching to the role, sudo will ask for the role account's password. I don't want to set that and share it with everyone. Can I instead make sudo ask for the original user's password?

Why not

  • Give the www-admin user a ~/bin/ folder with the appropriate commands all carrying suid permissions?

or

  • Edit /etc/sudoers and give the NOPASSWD attribute to various commands for the www-admin user. Then www-admin can run these via sudo without having to use any password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .