SYSTEM group - what can this do?

[senoralastair]

Hey folks,
I'm in a fairly restricted environment running AIX 5.3. The root account is locked down and password only disclosed with a whole lot of paperwork.

I've been trying to get a clearer of exactly what the members of the SYSTEM group can do, as i'm wanting to have enough permissions to do things like errclear, mksysb, shutdown, restart services, diag, all from my account, but i don't think i'm going to be allowed to install sudo.

So, looking up some ibm docs, i've found the following excerpt:

Sun Solaris to IBM AIX 5L Migration A Guide for System Administrators

System administrator groups
System administrator groups correspond to the SYSTEM group. SYSTEM
group membership allows an administrator to perform some system
maintenance tasks without having to operate with root authority.

Can anyone give me a better idea of what this group can & can't do, so i can justify to the powers above if i'm requesting membership to this group (i'm pretty much the one and only aix sysadmin here).

thanks in advance.

 

[senoralastair]

anybody?




if you're not too sure of the answer, do you seasoned guru's give your aix admins membership to this group by default? or is it something that you restrict?

 

[senoralastair]

hello?

anybody?

 

[khalidaaa]

Not very accurate definition (Some commands need more permissions):
SYSTEM group lets you run commands own by SYSTEM group!

eg:

ls -al /usr/sbin | grep system

-r-xr-xr-x 1 root system 5374 May 21 2006 backup

http://www.tek-tips.com/viewthread.cfm?qid=1530922&page=1

Regards,
Khalid

 

[senoralastair]

hi khalid.
Thanks for that. Do you recommend adding systems administrators to the SYSTEM group?

 

[khalidaaa]

Yes i do

 

[KenCunningham]

Is sudo an option in your environment? If you're 'pretty much the only sysadmin' surely you need access to the root account on a regular basis?

I want to be good, is that not enough?

 

[senoralastair]

yeah, i'm pushing to get sudo installed, but this environment is gov't regulated and it's a pain to get anything cleared, then there's the paperwork. sooner or later they'll see that we need sudo and let me have my way.

In the meantime I'll request to get the system group added so at least i can do a few more tasks...