The proper way to create a backup/restore user ??

[madmurdock]

Hi,

as a customer request, one should able to do a mksysb as a non-root user. I therefore studied the manual and learned, that the adminstravie role "ManageBackupRestore" is not sufficient to make a mksysb.

/usr/bin/mksysb is 544 with ownership bin.bin

Question: What is the IBM-supported proper way to have an non-root User enabled to make a mksysb.

regards
mad

Advanced Interactive eXecutable

 

[RMGBELGIUM]

you can use the sudo command to grant a user temporarily root permissions to execute the mksysb command.

rgds,

R.

 

[madmurdock]

Nice way, but the customer do not want to use sudo because of another overhead of adminstration.

Must be possible with standard AIX methods ...

mad


Advanced Interactive eXecutable

 

[columb]

I've got to back up RMGBELGIUM{/b]
I use sudo extensively. Once the software is installed (1 hr max) and the relvant line inserted into the sudoers file (10 mins) what further adminstrative overhead is there?

Personally I consider sudo to be a part of my 'standard' Unix install along with perl and ssh.

Columb Healy

 

[madmurdock]

Yes, you are all right, and sudo is a nice Sw, but I can not use it.

THere must be another way

mad

Advanced Interactive eXecutable

 

[KenCunningham]

Not recommended for security reasons, but I guess you could create a user with root equivalence (ie with a UID of 0), and edit that user's .profile to include only the mksysb command that you require, exiting immediately afterwards. Of course, this won't be 'IBM supported', but I doubt whether any other solution would be except perhaps sudo.

 

[RodKnowlton]

Sounds like it's time to be firm and educate the customer.

Using a security endangering method like making your own setuid program launcher or <shudder> creating another UID 0 user will only do them a disservice, and I personally would tell them they need to hire someone else if that's what they want to do.

What administrative overhead are they talking about with sudo? If they want regular users to be able to make a mksysb, all it takes is one line in /etc/sudoers.

Considering that sudo is part of the AIX Linux Toolbox, I'd say it's IBM approved, as well.

Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

 

[nimrodman]

I do agree with Rod, there is no overhead for Sudo, it seems to me that your clients are not very savvy of what they are talking about, no disrespect is implied, you need to explain things to them in a more basic manner.

Sudo is there best option.