Run script as another user without sudo/su privileges

Question

I'm trying to write a script so that it can be called by one user and is executed as another user. I thought that setuid might be able to do this so I enabled setuid using chmod u+s with the owner of the script being user1. I call the script (which only contains whoami right now) as user2 and it still shows user2 instead of user1. How can I make this be user1.

-- My end result is I want one user to be able to call this script and have it ssh into another server and execute a command as another user.

Why do you have to execute the script as another user? Is it because you want to use that user's SSH key to log in to the server? — Michał Wojciechowski, Sep 15 '11 at 21:32
Exactly. Even being able to source that user's key and login as them would work. — Paul, Sep 16 '11 at 13:24
Can't you just allow the actual user to log in to the server by adding his SSH key to the server user's authorized keys? — Michał Wojciechowski, Sep 16 '11 at 14:10
I would rather not considering I would have to push the key to 100+ servers. — Paul, Sep 16 '11 at 14:21
Yeah, `setuid` has the script run with the *privileges* of the owner, but not their identity. — Josh Wulf, Dec 30 '15 at 15:56

score 0 · Answer 1 · answered Dec 30 '15 at 15:59

0

Sounds like you need a third user in your security model, who can run the program, but is otherwise unprivileged. This third user is an assumable identity for a number of users so they can run the process on the remote server.

answered Dec 30 '15 at 15:59

Josh Wulf

4,727
2
20
34

score 0 · Answer 2 · answered Sep 16 '11 at 15:14

0

You can copy that user's key (id_rsa) and pass it to ssh when connecting to the server:

ssh -i user1_id_rsa user1@server

However, this is rather a bad solution, security-wise. Adding the user's key to the authorized keys on the server, as I said in the comment, is the proper way to do it, and you should really look into that.

answered Sep 16 '11 at 15:14

Michał Wojciechowski

2,480
15
9

Right, but user2 doesn't normally have access to user1's keyfile. – Paul Sep 16 '11 at 19:44

Run script as another user without sudo/su privileges

2 Answers2