permissions and groups?

[Spanik]

Until recently I always used a computer from the keyboard and screen on it as a single user. So switching to root to install something or even run something (I know...) wasn't an issue. I admit I never tought about groups and permissions or other admin tasks. But now I made a small system that I only want to access through the network from a windows pc.

I did the installation as root and created a user "remote_win", gave that user permissions to its home directory and made it member of the groups "wheel", "audio", "usb", "video". and "portage". Configured sshd to forward X and not allow root login.

Now I can connect to the box as user "remote_win", start graphical applications and use them. But whenever I want to do something a bit more than edit a .txt file in the home directory or read a .pdf in the /mnt/data it blocks saying that the command is not available or I do not have permission.

Things I'd like to do are:
- read /var/log/dmesg
- use fdisk -l to see if it found my usb stick
- mount a USB hd or stick
- emerge some applications I forgot to install
- use su

I tought that being member of "wheel" would permit usage of su and likewise that being member of "usb" and "wheel" would permit mounting a usb hard disc. Probably I forgot something or all this isn't as simple as it looks.
_________________
Expert in non-working solutions

[steveL]

Yeah there's other groups; here's what my admin-level user has:

[baaann]

I think you need to add the "users" group
Here are mine

[Spanik]

[steveL]

[Spanik]

OK, think I got it.

My created user is part of the "user" group. That wasn't the problem. And the rest was a wrong use of "su". So far it is PEBKAC.
_________________
Expert in non-working solutions

[steveL]

[Spanik]

Found a couple of other surprises as well... Apparently I did create both the user "remote_win" and "remote-win" and they didn't were part of the same groups and one of them didn't have its home directory. I'm cleaning the mess right now.

Surprise now is that I don't seem to be able to start kdm as normal user (says only root wants to run kdm) and it refuses to run fdisk as normal user (guess I'll have to belong to the sys group for that). Oh well, learning each day
_________________
Expert in non-working solutions

[AaylaSecura]

I don't know which of the original problems you've managed to solve, but:

1) I am not 100% sure about the difference is between the output of dmesg (which can be executed by any user) and the contents of /var/log/dmesg (which for unknown to me reason can only be read by root) - on my system /var/log/dmesg contains messages from earlier than what dmesg outputs, but that maybe because dmesg just reads a buffer of limited size and new information going there causes old one to be dropped; at the same time, /var/log/dmesg stops being written to soon after boot, so it's 'out of date' so to say; I don't know why you need to read the file instead of the output of dmesg, but I guess you can either change the permissions or owner group of the file (e.g. chown root:wheel or chmod 644) OR you can allow your user to execute sudo less /var/log/dmesg by adding
remote_win ALL=(root) NOPASSWD: /usr/bin/less /var/log/dmesg to sudoers
2) add remote_win ALL=(root) NOPASSWD: /sbin/fdisk -l to sudoers and make sure your user has permissions to read the device (i.e. the group owning the device is one of the groups your user is in; the permissions and owner of the device can be changed by a udev rule, assuming you use udev)
3) again, make sure your user has permission to read and write to the device, has read and write permissions to the mount point defined in /etc/fstab (or the mount point you specify if using fusermount)
4) I think it's best to do that as root once you 'su'
5) who can su is controlled by PAM, and more specifically what's in /etc/pam.d/su; mine reads:
auth sufficient pam_rootok.so
auth required pam_wheel.so use_uid
auth include system-auth
account include system-auth
password include system-auth
session include system-auth
session required pam_env.so
session optional pam_xauth.so
so users in the wheel group CAN su (2nd line)
also, it does not matter what sshd's configuration is - it simply means you cannot log in to root straight away (with ssh root@host); once you're logged in as your user you can su root if PAM allows you to
6) as for kdm: what's the point of running the login manager once you're logged in on the console; just start a KDE session manually

[steveL]

Nice post AaylaSecura; good to see examples of the various configs.

As for kdm, it's easiest to have that started via the xdm service (which starts any DM you like.)
/etc/conf.d/xdm:

[AaylaSecura]

[steveL]