Re: delegating limited privileges for user account administration

--gQHhiqnBT0oL9zTC
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline

On Sat, Jul 05, 2003 at 08:43:08AM -0400 or thereabouts, Kurt Lieber wrote:
> I need to be able to delegate certain user administration tasks (basic
> moves, adds and changes)  I can do this by allowing access to useradd,
> usermod and userdel via sudo, but I believe that also would allow those
> users to escalate their own privileges.  (for instance, using usermod to
> add themselves to the wheel group)  That is sub-optimal...

Answering my own question, I came up with the following /etc/sudoers
configuration:

-----------
Cmnd_Alias      USERADMIN = /usr/sbin/useradd, !/usr/sbin/useradd *wheel*, !/usr/sbin/useradd *root*, !/usr/sbin/useradd *-u 0*, \
                            /usr/sbin/usermod, !/usr/sbin/usermod *root*, !/usr/sbin/usermod *wheel*, !/usr/sbin/usermod *-u 0*, \
                            /usr/sbin/userdel, !/usr/sbin/userdel *root*, !/usr/sbin/userdel *wheel*, !/usr/sbin/userdel *-u 0*

%user-admins    ALL= USERADMIN
-----------

Any comments?  An easier way of accomplishing the same task?

--kurt

--gQHhiqnBT0oL9zTC
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/BuX9JPpRNiftIEYRAhp0AKCNUA6TA3MGx0eJrYjJqZrznTf0hgCfa47W
ckHQaF2ernYKUkNnYDBVj3Y=
=WDbO
-----END PGP SIGNATURE-----

--gQHhiqnBT0oL9zTC--