admin users - root access 1

[rondebbs]

Is it possible to set up a user that has all the priviliges of root? I noticed that there are groups such as adm, sys, system. Even if a user is in these groups he does not seem to have all priviliges.

What if the root password is lost on an aix box. Can another admin user login and reset the root password?

Thanks - Brad

 

[sbrews]

depending on what you want as a final solution, take a look at sudo:

http://www.gratisoft.us/sudo/

With sudo you can set up users to be able to start a shell as root, give elevated access to some commands while not turning them loose with everything, etc.

scott

 

[rondebbs]

I was hoping there was some way within native AIX to grant root priviliges. For example - in Windows if a user is a member of the administrators group he can do everything, with no restrictions.

 

[unclebrian]

I have done this in the past by setting up a user and then going in and editing the /etc/passwd file go change the UID and GID to zero.

 

[rondebbs]

WOW the 0:0 in /etc/passwd seems to work well as I can do everything that I tried. Interesting - when I type whoami it shows me as root rather than my real id (who am i shows my real id).

I'm guessing that my id would continue to work as root even if the root password is lost/forgotten? I know that it is unlikely to lose the root password but I heard this occured at one site. I'm not sure how they recovered.

 

[hfaix]

I don't know the size of your company, but changing my(or any) id to 0 in /etc/passwd would not fly with my auditors.

It's really not "that" hard to recover from a lost root password. I had to do it on a really old machine about 3 months ago. I think I booted from media, went into recovery mode (mounting rootvg), and reset it there.

If you really wanted to, you could probably even setup sudo to allow you to sudo change the root password if it was lost.....

 

[Ogzilal]

Hi,

Cloning root id in /etc/passwd is not the good way to give a user root privileges.
sudo as suggested by sbrews is the best way to make things clean.
You have a little to do for configuring sudoers and you know what user is able to run what command as root because sudo actions and intrusions are sent to a system log.

Ali