Using sudo to create roles.....
"Parker, Michael D." <[email protected]>
| Newsgroups | gmane.comp.tools.sudo.devel |
|---|---|
| Message-ID | <[email protected]> |
I've run into an interesting situation that sudo almost covers.
I was planning on establishing roles using groups, with group passwords and due to project restrictions I cannot use the NOPASSWD: option for a group.
I was thinking further it might be an interesting idea if sudo syntax and processing could be extended so that for any given line an option is provided as to which user/group account password is used to authenticate the transaction. Right now it is restricted to either the user password or the root password and this setting is of global scope. What is needed is something scoped to the specific sudo line.
The extension of the line syntax could something be like but I can see other alternatives as well:
username ALL=(ALL) USEUSERPW:rolemaster /usr/bin/someapp
username ALL=(ALL) USEGROUPPW:grouprole /usr/bin/someotherapp
This type of change would make it a lot easier to configure special privs on a role based model from what I can see.
Is this on the change list or even under consideration?
***** ***** *****
Michael D. Parker
General Atomics - EMS
[email protected]<mailto:[email protected]> <<<<< NOTE: Remember to include my middle initial >>>>>
+1 858 964 6675 / Office 86-1319 <<<<< NOTE: New Office Location >>>>>
16969 Mesamint Street / San Diego / CA / 92127
************************************************************************
CONFIDENTIALITY NOTICE: This communication is intended to be confidential to the
person(s) to whom it is addressed. If you are not the intended recipient or the agent of the
intended recipient or if you are unable to deliver this communication to the intended
recipient, you must not read, use or disseminate this information. If you have received
this communication in error,please advise the sender immediately by telephone and delete
this messageand any attachments without retaining a copy.
*************************************************************************
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers