1

How can one perform some administrative tasks from non-root account without becoming root on Debian 7? For example, my iptables block all network access for all users including root except one user - 'webuser'. The webuser is admin account, it is in admin and adm groups, it is in sudoers file and can use sudo. When I try as 'webuser' to use apt-get or synaptic via sudo, then after entering the root password the program apparently starts under the root account, not under webuser, and cannot get access to network.

Is there some configuration settings that can be set for synaptic or apt-get so that these programs could run under non-root account?

Improve this question
3
  • I would be very surprised...
    – MariusMatutiae
    Commented May 20, 2014 at 17:15
  • It's unclear whether these programs check for a particular account (root), or for a certain level of privileges. There is a group named 'root' on my system, and webuser is in this group, but cannot start apt-get without sudo anyways.
    – Al Berger
    Commented May 20, 2014 at 17:40
  • sudo means "super user do" and the super user is root. So, you are installing as root.
    – Bruno9779
    Commented May 20, 2014 at 20:45

1 Answer 1

Reset to default
1

Running package managers under non root account is an horrible idea. It is not possible by default, but you could probably hotwire it somehow, maybe with some chroot magic. And likely bork your system.

Think of a scenario where you install a library with webuser, the applications that use that library, if installed by root would not have access to it.

Some applications, like apache, let you configure what user and group the program should be run as (in /etc/httpd/conf/httpd.conf on centos), other do not give you any choice about it. Many applications need to run as a separate user.

I think you could achieve what you want by creating a group called webuser, with access to the network, adding to it the users of the programs that have access to the network and allowing members of the group to access the network in iptables.

Note that root will need to be part of webuser group for you package manager to work

Improve this answer
1
  • Well, I've workarounded the problem with a script wrapper for apt-get which temporary opens and then closes the net access for root by modifying iptables.
    – Al Berger
    Commented May 20, 2014 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .