As i know, Unix or Linux only manages 2 type of user: root user or normal user.
All users with userID=0 will have all administration permissions like root user with the system.
In my case, i want to create a new user in HP-UNIX environment with all root permissions only one exception that this user will not be able to create or delete or modify other existing users in current system.
Could you help me?
Thanks so much for your support,
What do you know about UNIX?
Sorry, a little.
The usual way to do something like that on Unix is to use 'sudo' to grant a list of capabilities to a user.
By definition "root" can do anything and it is very difficult to impose a limitation.
So, could you give me any solution for my question?
Thanks,
It depends very much what this user will be doing... if you give the rights at ahell prompt level (command line ) I say Good Luck...
If its for an operator using menus that may be different...
What is it for?
sudo elevates user rights by allowing to run certain commands as root There is no absolute safety in that: if a command can run other commands one gets more or all rights. Especially the shell allows everything.
A safer way to elevate user rights is RBAC (role based access control, see Wikipedia). Solaris has an RBAC implementation.
SELinux (Redhat) has another one.
--
But not HP-UX.
You can use another NIS server to provide the user identities (passwd and group), and make your HP-UX a NIS client. So root cannot delete a certain account or change its password. But still can switch to any identity, and create a local identity that covers/replaces the NIS account. NIS is not the only name service; there are LDAP or even Microsoft AD. In order to use these one needs a PAM (e.g. pam_ldap).
root does not work that way. You cannot take away abilities from root.
You can grant a non-root user the ability to run certain things as root, but not others, which would allow you to create a user which can do some tasks as root but not modifying users.