RUNNING IPTABLES TOOL AS A NON-ROOT USER
REQUEST
RELATED
SOLUTION
In this example, the user maxpatrol is being used.
First, you should back up your sudoers file
[root@rhel511 ~]# cp /etc/sudoers /etc/sudoers.$(date +%d%b%y)
[root@rhel511 ~]# ls -l /etc/sudoers*
-r--r----- 1 root root 3515 Apr 20 2017 /etc/sudoers
-r--r----- 1 root root 3515 Nov 19 10:41 /etc/sudoers.19Nov18
Then add the following line to the sudoers file
maxpatrol ALL=(ALL) NOPASSWD:/sbin/iptables
It’ll allow the user maxpatrol to execute /sbin/iptables executable without providing a password. Any arguments are allowed for that executable.
[root@rhel511 ~]# echo "maxpatrol ALL=(ALL) NOPASSWD:/sbin/iptables" >> /etc/sudoers
[root@rhel511 ~]# egrep maxpatrol /etc/sudoers
maxpatrol ALL=(ALL) NOPASSWD:/sbin/iptables
Switch to the maxpatrol user and test if you are able to list iptables rules
############################
## Without sudo keyword
############################
[root@rhel511 ~]# su - maxpatrol
[maxpatrol@rhel511 ~]$ /sbin/iptables -nvL
iptables v1.3.5: can't initialize iptables table `filter': Permission denied (you must be root)
############################
## With sudo keyword
############################
[maxpatrol@rhel511 ~]$ sudo /sbin/iptables -nvL
Chain INPUT (policy ACCEPT 1 packets, 484 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 2 packets, 842 bytes)
pkts bytes target prot opt in out source destination
Everything works with sudo keyword. But I want to eliminate using sudo keyword, so a trick should be used.
Issue the following command to create a script
{ echo "sudo /sbin/iptables \${1}" > /home/maxpatrol/iptables chmod 500 iptables ls -l iptables }
[maxpatrol@rhel511 ~]$ {
> echo "sudo /sbin/iptables \${1}" > /home/maxpatrol/iptables
> chmod 500 iptables
> ls -l iptables
> }
-r-x------ 1 maxpatrol auditor 21 Nov 19 10:52 iptables
Here the script name is the same as the name of iptables executable. Run the script to verify it works
[maxpatrol@rhel511 ~]$ ./iptables -nvL
Chain INPUT (policy ACCEPT 2858K packets, 3924M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 2895K packets, 4656M bytes)
pkts bytes target prot opt in out source destination
So, script works. As the next step of the trick I need to call my script by default instead of original iptables executable. For this purpose the script location must be added to PATH variable.
[maxpatrol@rhel511 ~]$ export PATH=/home/maxpatrol:$PATH
Now you should be able to run the script by its name
[maxpatrol@rhel511 ~]$ iptables -nvL
Chain INPUT (policy ACCEPT 3745K packets, 5030M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 3764K packets, 5551M bytes)
pkts bytes target prot opt in out source destination
And as the final step, add the script path to PATH variable in .bash_profile file
[maxpatrol@rhel511 ~]$ echo "export PATH=/home/maxpatrol:\${PATH}" >> ~/.bash_profile
[maxpatrol@rhel511 ~]$ egrep PATH ~/.bash_profile
PATH=$PATH:$HOME/bin
export PATH
export PATH=/home/maxpatrol:${PATH}
Relogin and verify it again
#########################
## Relogin
#########################
[maxpatrol@rhel511 ~]$ exit
logout
[root@rhel511 ~]# su - maxpatrol
#########################
## Ensure the iptables command points to your script
#########################
[maxpatrol@rhel511 ~]$ which iptables
~/iptables
#########################
## Execute command
#########################
[maxpatrol@rhel511 ~]$ iptables -nvL
Chain INPUT (policy ACCEPT 5058K packets, 6191M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 5106K packets, 6848M bytes)
pkts bytes target prot opt in out source destination
Platform : Red Hat Enterprise Linux Server release 5.7 (Tikanga)
Related Posts
Leave a Reply Cancel reply
This site uses Akismet to reduce spam. Learn how your comment data is processed.
Categories
- Linux (8)
- Iptables (2)
- Memory Usage (1)
- Postfix (1)
- Yum (4)
- Networker (2)
- Oracle (63)
- Account (2)
- AWR (2)
- Database Errors (6)
- Database Performance (9)
- Datapump (3)
- Enterprise Manager (24)
- Enterprise Manager Metrics (4)
- Environments (4)
- High CPU Usage (2)
- High IO Load (4)
- Initialization Parameters (5)
- job_queue_processes (1)
- Processes (3)
- NLS (1)
- Objects (1)
- Objects DDL (2)
- OJVM/PSU/DRU Patches (1)
- PL/SQL (5)
- UTL_FILE (4)
- Prerequisites (1)
- Privileges (1)
- Profile (1)
- Queries (2)
- Redologs (1)
- Resource Limits (1)
- Segment Shrink (1)
- Session (6)
- Spfile (3)
- SQL PLUS (1)
- Spooling (1)
- Standard Queries (7)
- Statistics (2)
- Temporary Tablespace (2)