Allow "sudo su - USER" to only the specified user

[Russ Long]

I'm trying to come up with a Sudo rule that will allow a user to "su" to
only a single specified user. I need to give a DBA access to the oracle user account.  

This serverfault article details exactly what I want to do, however this is not for
FreeIPA.  

I've tried creating a sudo command that's "/usr/bin/su - USER" and other
variations to no avail. 

I've also tried creating a sudo rule that allows all commands to be run as
"USER".

[Russ Long]

And caching is no fun.  The second option, to allow all commands to be run as the
specified user works if I wait for the cache to expire.

[Angus Clarke]

I edited sudoers by hand however it should give you something to aim towards ...

[root@orable76 ~]# grep angus /etc/sudoers
angus   ALL=NOPASSWD: /usr/bin/su - appuser

[root@orable76 ~]# su - angus
Last login: Fri Jan 22 17:01:30 CET 2021 on pts/0

[angus@orable76 ~]$ sudo su - appuser
Last login: Fri Jan 22 17:01:31 CET 2021 on pts/0
[appuser@orable76 ~]$

Regards
Angus

________________________________
From: Russ Long via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
Sent: 22 January 2021 16:33
To: freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Russ Long <kd8fre(a)gmail.com&gt;
Subject: [Freeipa-users] Allow "sudo su - USER" to only the specified user

I'm trying to come up with a Sudo rule that will allow a user to "su" to
only a single specified user. I need to give a DBA access to the oracle user account.

This serverfault article details exactly what I want to do, however this is not for
FreeIPA.

I've tried creating a sudo command that's "/usr/bin/su - USER" and other
variations to no avail.

I've also tried creating a sudo rule that allows all commands to be run as
"USER".
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.f...
List Guidelines:
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedora...
List Archives:
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists....

[Angus Clarke]

sss_cache -E to invalidate all cache, you can be more refined with other options.

Regards
Angus

________________________________
From: Russ Long via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
Sent: 22 January 2021 16:39
To: freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Russ Long <kd8fre(a)gmail.com&gt;
Subject: [Freeipa-users] Re: Allow "sudo su - USER" to only the specified user

And caching is no fun.  The second option, to allow all commands to be run as the
specified user works if I wait for the cache to expire.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.f...
List Guidelines:
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedora...
List Archives:
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists....

[Dominik Vogt]

On Fri, Jan 22, 2021 at 03:33:50PM -0000, Russ Long via FreeIPA-users wrote:
>  I'm trying to come up with a Sudo rule that will allow a user to
>  "su" to only a single specified user. I need to give a DBA access
>  to the oracle user account.
>
>  This serverfault article details exactly what I want to do,
>  however this is not for FreeIPA. 
Which article?

>  I've tried creating a sudo command that's "/usr/bin/su -
> USER"
>  and other variations to no avail.
>
>  I've also tried creating a sudo rule that allows all commands to
>  be run as "USER". 
Is there a specific reason why you need "sudo su" instead of using
just sudo?

With this rule in /etc/sudoers:

  fromuser hostname = (touser) NOPASSWD: ALL

The user "fromuser" can execute any command on the machine
"hostname" as the user "touser" without entering a password, for
example:

  $ sudo -u touser /usr/bin/bash

to start a shell.

Ciao

Dominik ^_^  ^_^

--

Dominik Vogt

[Russ Long]

Thanks all, I'm trying to do this all in IPA as I have a fleet of boxes this rule
needs to be setup on. 

I was able to create the rule in the IPA GUI, but now, trying to create it using the
`ipa_sudorule` Ansible module is giving me fits.  I can't figure out how to add the
`Run As User` to the Ansible config.

[Larkin, Patrick]

On 1/22/2021 10:16 AM, Dominik Vogt via FreeIPA-users wrote:
> ______________________________________________________________________
>  On Fri, Jan 22, 2021 at 03:33:50PM -0000, Russ Long via FreeIPA-users wrote:
> > I'm trying to come up with a Sudo rule that will allow a user to
> > "su" to only a single specified user. I need to give a DBA access
> > to the oracle user account.
> >
> > ...
>  Is there a specific reason why you need "sudo su" instead of using
>  just sudo? 
I agree with Dominik:  "sudo su" is a pet peeve of mine.  It is 
unnecessary and actually less secure.   Use "sudu -u youruser" instead.
setup like this:

  ipa sudorule-add-runasuser --users=jsmith readfiles


https://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/definin...


-- 
Pat Larkin <Patrick.Larkin(a)Sabre.com&gt; | TEO | Texas USA  |
Principal | Linux Infrastrucuture Managment & Operations |

[Russ Long]

OK, OK, I had a bad title, but as I mentioned in my original message, I've also tried
creating a sudo rule that allows all commands to be run as
"USER".  Anyways, I'm now on to trying to figure out how to make the
ipa_sudorule module work with this RunAs user config, since that doesn't seem to be a
valid option in the module.

[Dominik Vogt]

On Fri, Jan 22, 2021 at 05:11:43PM -0000, Russ Long via FreeIPA-users wrote:
>  OK, OK, I had a bad title, but as I mentioned in my original
>  message, I've also tried creating a sudo rule that allows all
>  commands to be run as
>
>  "USER".  Anyways, I'm now on to trying to figure out how to make
>  the ipa_sudorule module work with this RunAs user config, since
>  that doesn't seem to be a valid option in the module. 
The ipa-modules in the Ansible distribution aren't very good.  Try
the ansible-freeipa packet instead, the module's name is
"ipasudorule" without the underscore.  See

  https://github.com/freeipa/ansible-freeipa

It's also included in RHEL8, but the version included is quite
old.  I had to install the current version (0.3.1) manually to get
the functions I needed.

Ciao

Dominik ^_^  ^_^

--

Dominik Vogt

[Russ Long]

Thanks Dominik, that did the trick!