Add a user to the sudoers

Feature
6

With sudo you can delegate some users to run specific commands (even with a list of valid parameters) with root privileges.

Correct if I’m wrong: you’re trying to give root access to a specific user, not to delegate some tasks with sudo.
In this case, giving the power to become root is a matter of adding a user to the wheel group.

This is the upstream doc: Chapter 6. Gaining Privileges Red Hat Enterprise Linux 7 | Red Hat Customer Portal

2 Likes
7

It is the correct procedure, but I’m afraid both CLI commands (i.e. usermod, lusermod, samba-tool) and the UI cannot add to wheel (a group defined by /etc/group) an user coming from LDAP or AD.

We could set (as opt-in) “domain admins” (or any other group in LDAP or AD) as a “wheel” equivalent, though. We have the admins key in configuration DB…

2 Likes
8

yes the purpose is to gain/delegate root access. Imagine I ssh a server to fix/search a bug, I might need privileged accesses and rights but momently, not forever :slight_smile:

Ideally I prefer the sudo rights for a ‘baby’ administrator, you could hope that he’ll forget the sudo before to do ‘rm -rf /var/lib/nethserver’

1 Like
9

‘rm -rf /var/lib/nethserver’ is not as much fun as rm -rf / :innocent:

1 Like
10

Linux is an adult now…you cannot do it anymore…you need to give more arguments :slight_smile:

1 Like
11

Never understimate idiots :wink:

2 Likes
12

Or bad luck

1 Like
13

Or argue with them - they will drag you down to their level and beat you with experience…

3 Likes
14

I agree, we could automatic five sudo access to admins.
Or, as an alternative, we can create an ad-hoc group.

@bwdjames you can solve your problem like this (not tested):

  1. create a group powerusers in Users & Groups page
  2. add one ore more user to the group
  3. create a sudo file like this:
echo "%powerusers	ALL=(ALL)	ALL" > /etc/sudoers.d/90powerusers
chmod 440  /etc/sudoers.d/90powerusers
4 Likes
15

Will give it a try later this evening or tomorrow, schedule over booked last night and today

1 Like
16

@giacomo I can confirm that this works and is a very good solution to have in the documents somewhere.

1 Like
17

Should I add it to the developer manual or would you like to try to open a pull request on the readme file?

18

just my 2C question. Is it possible to get a sudo group, created by the rpm, and add users when it is needed in this group. An automatic task is interesting, a RTFM solution could be quite boring

19

This is not possible on NS 7 because you don’t know where accounts are stored, locally on a LDAP or even on a remote Microsoft Active Directory.

2 Likes
20

So “root” account for management is not member of groups?

21

The “root” user is member only of the root group itself.

22

So there are groups on server :smiling_imp: :smiling_imp::smiling_imp:.
This means that should be possible to create another group… the sudoers. :laughing:

1 Like
23

do you think your solution is workable if the account provider is remote ?

24

answering myself : yes :slight_smile:

1 Like
25

6 posts were split to a new topic: Cockpit users see an error instead of values