Re: [gentoo-server] su program and its limitations.

[Sri Gupta]

It's not a limitation of gentoo's shadow package, its a matter of using the
right tool for the job.  su is for switching between active users, use sudo for
executing programs /as/ different users.

Try merging sudo then using sudo -u username "start application".  

-Sri
-- 
sri.gupta@×××××××××××.ca
McGill University
Montréal, PQ, Canada

Quoting Miguel Sousa Filipe <miguel@×××××××××××.pt>:

> Hello all,
>
> The su program in gentoo, that comes with  sys-apps/shadow is in my view
> very limited.
>
> In a Suse system, I had several system users with /bin/false has a
> shell, since all they did was use the email, and ftp for site updates.
> Now that this instalation was migrated to gentoo, I am unable to do
> things like: su username -c "start aplication", simply because this
> version of su  passes it has an argument to the login shell.
> And there is no way to override the defined shell.
>
> Basically, and in short words, this sucks!
> I had users that were used to execute tomcat, or a sybase database, and
> now they are obliged to have a shell. There is no need for those users
> to have a shell.
>
> More problematic it is with users with mail acounts, that only use the
> system for mail, but there is sometimes the need to su username -c
> /bin/bash to do or to check certain things.
> The reason their shell was /bin/false is because these users are simple
> office workers who might leave their password in a postit or in a
> drawer. It is a good idea to limit their shell access to the
> email/web/database server.
> (there isn't the need for a big  security or containment policy enforcing)
>
>
> The Suse version of su comes with:
> # rpm -qf /bin/su
> sh-utils-2.0-106
> and supports the -s argument for passing a valid shell. (and the man
> page is very nice)
> Our (gentoo) su, doesn't support the -s argument.
>
>
> Is there a way that we have a more flexible, or less limited 'su' by
> default?
>
> Congrats to the gentoo developers, gentoo is "emerging" in the
> enterprise world..
>
> --
>
>  Miguel Figueiredo Mascarenhas de Sousa Filipe
>  email: miguel@×××××××××××.pt (PORTUGAL)
>  http://mega.ist.utl.pt/~miguel
>
>  Equipa de Administração de Sistemas
>  Rede das Novas Licenciaturas (RNL)
>  Instituto Superior Técnico
>  http://www.rnl.ist.utl.pt
>  http://mega.ist.utl.pt
>
>