List of AIX commands that can be run by ROOT user ONLY

Hello,

I am testing sudo and I want to test it. Can anyone please let me know few commands (of course other than shutdown, reboot etc. as I can't reboot the box) on AIX that can be run by ROOT only.

Thanks

---------- Post updated at 07:43 PM ---------- Previous update was at 07:38 PM ----------

Never I mind i prepared one-line script to which i assigned 700 permission and owner to root and It solved my purpose.

However I'm still interested to know few commands that can be run only by root. (In solaris, "format" command can be run only by root).

Isn't that a bit like asking who can drive my car?

It depends on who you have given the keys too, or if you are out and left the keys at home, or work, who knows which drawer you keep them in, and who has access to your home or office...

Who can, or has, changed the permissions on any file or directory...

Who has access to the system and what permissions they might have to enable then to gain access...

The list is endless depending on your configuration...

If you are asking from a default AIX install perspective then it will probably also depend on the exact level, what is installed, who or what has access via various different methods - Tivoli Access Manager, HMC commands via RMC, Etc.

I don't think you'll ever find a definitive list.

HTH

Am/was NOT asking for definite list. Asking for 1 or 2 standard AIX commands that can be run by ROOT only (on default AIX configuration). To make your job easier I gave an example of such command on Solaris as well.

one example of such command from you would have helped me more than Your 10 lines.

I am not familiar with AIX, but perhaps you could search for all executables that are owned by root and for which only root has executable permission:

find /sbin /usr/sbin -user root -perm -100 ! -perm -010 ! -perm -001

I used two directories (/sbin, /usr/sbin) which (at least on systems that I've used) typically include system daemons and utilities.

Regards,
Alister

installp requires root when not using RBAC.

Why not use RBAC? I have written a number of blogs on that. use a search engine with keyword SecuringAIX if you are interested in a second approach.

Instead of asking us you could have easily used "find" (which is executable by everybody) to search for files owned by "root" which have the owners x-bit set and the x-bits for group and world unset. Do this on the most likely directory ("/usr") and you end up with a more or less definitive list for your system.

If you are interested in only one example you could - to save time while making the list even less definitive - have started in "/usr/sbin", because most statically linked binaries are for use by root and root alone.

To come up with such a 1-second-of-thinking approach should be easy enough for an expert like you who is proficient in so many UNIX-dialects, hm?

Even one example would have been misleading because of the reasons dukessd explained so patiently to you. Probably he had the same solution like mine in mind and was trying to find out what kept you from using such an obvious approach.

In general, if you don't like our problem-solving skills and can do better without us - do so! Most of us have enough to do to not get bored all day long even without having to provide obvious solutions to others problems.

I hope this helps.

bakunin

2 Likes