I want to create "role" accounts for several admin tasks that don't usually require root permissions. For example, consider a www-admin
user maintaining files in /var/www
.
It seems to me that this is the easiest way to solve file permission issues: It would make sure that everyone assuming this role creates files with permission/ownership so that everyone else with this role can edit/read, without using a group-writeable access mode.
Users could switch to this role using sudo su www-admin --preserve-environment --shell /bin/bash
or a similar command.
There are two issues I am having with this:
Sometimes, the
www-admin
role needs to performsudo
tasks. But after switching to the role,sudo
will ask for the role account's password. I don't want to set that and share it with everyone. Can I instead make sudo ask for the original user's password?After switching to the role, users may need to use SSH, for example to checkout git repos. But, permissions of the SSH auth socket are (of course) set up in a way that the "role" user ID may not read from it.
I am sure this is a pretty common issue in multi-person admin teams. How do you solve this?
Also, I've noted that the sudo
man page says "The invoking user's real (not effective) user ID...". So, if there is a difference between real and effective user ID, does that help here...?