How to setup sudoers file ?

UNIX for Beginners Q & A
1

Hi,

I have several employees of whom we have created Linux user ids as below.

fred
mohtashim
jhon
matt
croft
....

[jhon@techx ~]$ id
uid=1018(jhon) gid=1003(techx) groups=1003(techx) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Note: All my employee users belong to techx group.

I wish to install products like 1. apache http webserver using "apache" id 2. oracle database using "oracle" id 3. weblogic server using "weblogic" id.

sample apache id:

uid=1015(apache) gid=1007(apache) groups=1002(apache) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Now, how should i setup my sudoers file so that employees can switch to "apache, "oracle" and "weblogic" functional id only not as root.

I am looking at something like this.

[jhon@techx ~]$ sudo -u apache -s -H

Summary of my requirement: All users of group techx should be able to sudo to -> apache, oracle and weblogic.

Can you please suggest ?

2

For example

fred ALL=(apache) ALL

allows fred to switch to the apache user. He has to enter his own password every time he switches. If he shall be allowed to switch without entering his password, write:

fred ALL=(apache) NOPASSWD: ALL

---------- Post updated at 21:17 ---------- Previous update was at 21:16 ----------

OK, just saw your edit. If you want to assign rights to a group, use for example:

%techx ALL=(apache) NOPASSWD: ALL
1 Like
3

what if i wish to switch all techx group users to apache group and NOT apache user?

4

sudo switches users, not groups. But you can assign the apache group to those users as secondary group

usermod -a -G apache fred

After this, fred is a member of both groups simultaneously. Both groups are used to check access rights to files, etc. If fred wants to change his primary group to apache, he can use

newgrp apache

which swaps his primary and secondary group. For access checks, nothing has changed, but new filesystem objects will have apache has their group.

If you need to replace these users' primary group with apache permanently, just use

usermod -g apache fred
1 Like