*nix shutdown permissions

[Kooldino]

Is there a way you can set up a *nix user account so that a user can do pretty much NOTHING except shut a system down? Anyone know how?

[albatorsk]

Uhm, make the users shell /sbin/halt. That ought to take care of it. It's not a pretty solution, but it works :P

[Kooldino]

Originally posted by albatorsk
Uhm, make the users shell /sbin/halt. That ought to take care of it. It's not a pretty solution, but it works :P

HAHAHHAHAA, that's a GREAT idea, albeit a bit rough around the edges. Does it definitely work?

Either way, I'd still like to know how to do the user permissions thing for that if someone knows for future reference.

[albatorsk]

To make the first solution work, you need to check what permissions are needed on yor box to halt it. You could for example check to see what group the halt command is owned by, and put the "halt"-user in the same group (and make sure that the group has execute permissions on the file).

The second way is a bit more tricky. You see, most systems are set up with most binaries executable by everyone, so in order to change that, you have to either change the permissions of every single file on the system, or set up a chrooted jail for the single user. This on the other hand, has the effect that he can't reach anything on the system except for what's in his "jail". Do a search for chroot on Google for more information.

[Kooldino]

Originally posted by albatorsk
or set up a chrooted jail for the single user. This on the other hand, has the effect that he can't reach anything on the system except for what's in his "jail". Do a search for chroot on Google for more information.

I'm gonna go check this out for grins, but I may just go w/ your original suggestion. Are there any downsides of your original idea?

[Marshmallowman]

is this a single system, eg no remote users?

You could just tell em atrl_alt-del and turn of the power button .

my solution, as I am to lazy to type

shutdown -h now

which works for a normal user (in mandrake anyway)

[TnT]

I'm curious as to why you want to setup a user like this?

[Kooldino]

Originally posted by TnT
I'm curious as to why you want to setup a user like this?

It's kind of complicated to explain, but basically I need to allow someone who doesn't use the system to be able to shut it down.

[Ribbit]

Originally posted by Marshmallowman
You could just tell em ctrl_alt-del and turn of the power button.

I think you can make ctrl-alt-del shut the machine down (or do anything else you like) anyway. man init or man inittab - I'm too lazy to look it up myself right now.