Re: How to give administrative previledges

[Chethiya K Ranaweera <ckranaweera gmail com>]

On Apr 6, 2005 4:12 PM, Les Mikesell <lesmikesell gmail com> wrote:
> On Wed, 2005-04-06 at 14:21, Scot L. Harris wrote:
> > >
> > > Giving root password to a user is not wise. My question is why can't
> > > we give change GID to 0 or some thingelse and grant any aceess to
> > > somebody else, let's say, a part-time administrator?? So that he can
> > > update the system, look in /lost+found ...etc.
> >
> > Granting even partial privileges problematic.  You must trust the user
> > you are giving that ability to.  Allowing someone to update the system
> > and access pretty much anything on the system via any means is the same
> > as giving them root password.
> >
> > If you are trying to provide limited admin access the proper way is what
> > has been suggested, use sudo to provide the limited access.
> >
> > If you want to allow someone to do pretty much anything then they should
> > be allowed to use su - to get root access.  If you don't trust them with
> > that then I would not trust them to update the system.
> >
> > Not giving out root access but allowing them to do anything on the
> > system that requires root access does not make much sense.
> 
> Realistically, someone who had to ask that question in the first place
> is not going to be able to configure sudo to the extent needed to
> allow a useful set of operations but prevent unauthorized operations.
> That's probably not even possible - for example you might want an
> operator to be able to change all passwords except for root.
> So, you might as well admit that you have to trust the person doing
> the administration.  If you don't, I'd consider webmin as a better
> starting place than sudo.
> 
> --
>  Les Mikesell
>   les futuresource com
> 
> 
> --
So if this is the case, I would like to pose a question from my
original assumption. What is the purpose of having a GID for root?
>From the above discussion, what I understand is that, even if you
modify /etc/sudoers (say, give a user admin access by adding (ALL) ALL
), the system is not going to give *ALL* admin access to that user. So
in that case, I truely do not understand of having a UID for root.