is this possible

[carpman]

Is it possible when logged in as root to run command as user, bit like sudo in reverse?

cheers

[jggimi]

The general syntax for a sudoers rule is:

user system = (run as) commands

e.g.:

carpman ALL = (operator) ALL

Would allow you to execute any command as "operator" on any host with this rule in the sudoers file.

Then you would:

$ sudo -u operator <whatever>

Disclaimer: I haven't run the rule through visudo to check it. You may need to adjust it.

[DutchDaemon]

su - someuser -c command should work

[jggimi]

su(1) will work when logged in as root; otherwise the password for the "run as" user is required.

Using sudo, any user can be permitted to "run as" another, without needing that userid's password. In addition, one can "run as" another user that does not have a usable $HOME or login shell.

[carpman]

Hello and thanks for replies.

the su method seemed to fail

su - wwwuser -c touch /hsphere/local/home/wwwuser/test.txt
The parent process is not sshd. Exiting...

This maybe related to an sshd issue i have though.


but sudo method worked for touch

sudo -u wwwuser touch /hsphere/local/home/wwwuser/test.txt

Did not work for script app.sh but think that maybe another issue i looking into.

cheers

[jggimi]

re: su

On OpenBSD, the -c option is for login class, not for command. See the su(1) man page.

Here's an example of substituting the identity of a typical "nologin" userid:

# su -m nobody
ksh: Cannot determine current working directory
$ touch /tmp/test
$ exit
# ls -l /tmp/test
-rw-r--r--  1 nobody  wheel    0 Feb 18 13:05 /tmp/test

[jggimi]

Ooops. This is FreeBSD. Sorry. But -c is still login class. See the FreeBSD version of su(1).

[DutchDaemon]

See the examples in that same manual ..

EXAMPLES
     su -m man -c catman
            Runs the command catman as user man.  You will be asked for man's
            password unless your real UID is 0.  Note that the -m option is
            required since user ``man'' does not have a valid shell by
            default.
     su -m man -c 'catman /usr/share/man /usr/local/man'
            Same as above, but the target command consists of more than a sin-
            gle word and hence is quoted for use with the -c option being
            passed to the shell.  (Most shells expect the argument to -c to be
            a single word).

And:

su -m www ps    
/bin/ps: /bin/ps: cannot execute binary file

su -m www -c ps  
  PID  TT  STAT      TIME COMMAND
 1023  p0  R+     0:00.00 ps

[jggimi]

Can you explain why the EXAMPLES don't match the SYNOPSIS in that man page? One of them is wrong.