Restricting users from certain privileges

[Freddie Cash]

On Apr 28, 2012 12:50 AM, "Zenny" <garbytrash at gmail.com> wrote:
>
> On Sat, Apr 28, 2012 at 9:38 AM, Daniel Braniss <danny at cs.huji.ac.il>
wrote:
>
> > > Hi:
> > >
> > > I could not figure out how to restrict users or other users from
certain
> > > privileges to execute certain commands in FreeBSD/NanoBSD?
> > >
> > > What I meant is I want to create a NanoBSD image in which there will
be
> > an
> > > additional user, say 'admin'. I need to give this new user (admin)
some
> > > privileges to run some root-can-only-execute commands, but not all
(ACL
> > > similar to the firmwares in adsl modems from ISPs).
> > >
> > > I read Dru Lavingne's 'BSD Hacks' and Joseph Kong's 'Designing BSD
> > > Rootkits' besides FreeBSD handbook, but I simply could not figure out.
> > > Could anyone throw some light on this? Appreciate it!
> > >
> > > Thanks!
> > >
> > > /zenny
> >
> > try sudo from ports, security/sudo
> >
> > cheers,
> >        danny
> >
> >
> Thanks Daniel, but sudo gives all (not selective) root privileges to the
> user (admin in my case). So this is not what I am trying to achieve in my
> original post.

Sudo let's you do a lot more than all-or-nothing access. You can specify
individual commands that can be run, even down to the options that can be
used, and whether or not they need a passwd. And you can even specify which
user to run the command as (doesn't have to be root).

Read through the sudoers(5) man page and the comments in the default
sudoers file for all the gory details.

Cheers,
Freddie Cash
fjwcash at gmail.com