koerberm@nixsin.UUCP (Mathias Koerber) (01/16/91)
Howdy, I have a (small) system, which I want all my staff to be able to shutdown in the evening, without having to give them full root access. So i created a user "shut", whose .profile calls /etc/shutdown with all the necessary parameters. I want to protect this account against being accessed via su, so that it is not used accidentally. How can I do this? I already check the number of logged-in users to be one (=shut), so that it only can be used once everybody is out. But a su would not increase that number. Any help appreciated Mathias -- Mathias Koerber | S iemens | EUnet: koerber.sin@nixdorf.de 2 Kallang Sector | N ixdorf | USA: koerber.sin@nixdorf.com S'pore 1344 | I nformation Systems | Tel: +65/7402852 | Fax: +65/7402834 * Packed with Power, SNIckers really satisfy (or do they? Ask them gals :-) )*
israel.pad@sni.de (Andreas Israel) (01/16/91)
In <1460@nixsin.UUCP> koerberm@nixsin.UUCP (Mathias Koerber) writes: >I have a (small) system, which I want all my staff to be able to shutdown in >the evening, without having to give them full root access. So i created a user >"shut", whose .profile calls /etc/shutdown with all the necessary parameters. You can interrupt the execution of the .profile after login!!! >I want to protect this account against being accessed via su, so that it is not >used accidentally. How can I do this? You can write a little C program that will do all checking and finally call /etc/shutdown. Specify this program as login shell for this user in /etc/passwd. Another way is to give SETUID root permission to such a program.
subbarao@phoenix.Princeton.EDU (Kartik Subbarao) (01/19/91)
In article <1460@nixsin.UUCP> koerberm@nixsin.UUCP (Mathias Koerber) writes: >Howdy, > >I have a (small) system, which I want all my staff to be able to shutdown in >the evening, without having to give them full root access. So i created a user >"shut", whose .profile calls /etc/shutdown with all the necessary parameters. > >I want to protect this account against being accessed via su, so that it is not >used accidentally. How can I do this? To avoid all hassles of making a new user with user id 0, you can simply write a small C program (as opposed to a problematic shell script) that execl's /etc/shutdown with the desired parameters, and make that program set UID root. i.e: main() { execl ("/etc/shutdown", "shutdown", "Your arguments here", (char *) 0); } and everything is okay. -Kartik -- internet# find . -name core -exec cat {} \; |& tee /dev/tty* subbarao@{phoenix or gauguin}.Princeton.EDU -|Internet kartik@silvertone.Princeton.EDU (NeXT mail) -| SUBBARAO@PUCC.BITNET - Bitnet
mike (Michael Stefanik) (01/20/91)
In article <1460@nixsin.UUCP> nixsin.UUCP!koerberm (Mathias Koerber) writes: >Howdy, > >I have a (small) system, which I want all my staff to be able to shutdown in >the evening, without having to give them full root access. So i created a user >"shut", whose .profile calls /etc/shutdown with all the necessary parameters. > >I want to protect this account against being accessed via su, so that it is not >used accidentally. How can I do this? There is no way to allow an account for login, but disable it for su (that I know of ...); however, here are some alternatives. One way would be to write a program that exec()'d /etc/shutdown, and ran suid, such as: ---[ cut here, call shut.c ]--------------------------------------------------- #include <stdio.h> #define MAGIC_GID 100 main(argc,argv) int argc; char *argv[]; { FILE *fp; int users = 0; char buf[128]; if ( getgid() != MAGIC_GID ) { fprintf(stderr,"%s: you are not allowed to shutdown\n",argv[0]); exit(1); } if ( (fp = popen("who","r")) == NULL ) { fprintf(stderr,"%s: cannot shutdown system\n",argv[0]); exit(1); } while ( fgets(buf,128,fp) != NULL ) ++users; fclose(fp); if ( users > 1 ) { fprintf(stderr,"%s: everyone is not logged out!\n",argv[0]); exit(1); } execlp("/etc/shutdown","/etc/shutdown",NULL); } ---[ cut here ]-------------------------------------------------------------- You would then compile this program, make sure the owner was root, and chmod "shut" to 4111. Thus, all your non-root admin would have to do is enter /etc/shut (or whatever) to allow them to shut the machine down when no one is using it. Note that MAGIC_GID should be changed to the group id of your non-root admin; others won't be allowed to use it. Another option would be to have the system shutdown on it's own, by putting a "fast shutdown" command in root's crontab, such as: sh -c "sync; sleep 5; /etc/haltsys" I know this isn't what you're explicitly asking for, but it is some alternatives I thought I'd throw out there. -- Michael Stefanik, Systems Engineer (JOAT), Briareus Corporation UUCP: ...!uunet!bria!mike -- technoignorami (tek'no-ig'no-ram`i) a group of individuals that are constantly found to be saying things like "Well, it works on my DOS machine ..."
dstrombe@ucqais.uc.edu (pri=2 Dan Stromberg) (01/21/91)
In article <1460@nixsin.UUCP>, koerberm@nixsin.UUCP (Mathias Koerber) writes: > Howdy, > > I have a (small) system, which I want all my staff to be able to shutdown in > the evening, without having to give them full root access. So i created a user > "shut", whose .profile calls /etc/shutdown with all the necessary parameters. > > I want to protect this account against being accessed via su, so that it is not > used accidentally. How can I do this? > > I already check the number of logged-in users to be one (=shut), so that it > only can be used once everybody is out. But a su would not increase that number. > > Any help appreciated > > Mathias > -- > Mathias Koerber | S iemens | EUnet: koerber.sin@nixdorf.de > 2 Kallang Sector | N ixdorf | USA: koerber.sin@nixdorf.com > S'pore 1344 | I nformation Systems | Tel: +65/7402852 | Fax: +65/7402834 > * Packed with Power, SNIckers really satisfy (or do they? Ask them gals :-) )* Disclaimer: I haven't tried this. The only thing I have root access on these days is Minix. :-( One alternative: write a C program that returns a status indicating if the current user's *effective* user id is equal to the current user's *actual* user id. You could then use that status in an if, determining if you actually want to shut down or not. Or... I suppose a more (re)useful way of doing it, would be to write an "ewho" program, that printf's the effective user id (eg "root", not the numbers), and use a string comparison against its output, and the first field of `who am i`. Heh. Of course, I just tried $ who am i on this machine, and it didn't output a thing... so maybe the first suggestion work better. :-) - Dan