0

I want to parse /etc/passwd file to find out if the user has root privilege and can run interactive shell.

according to

UID 100-999 are reserved by system for administrative and system accounts/groups

what I understood is if the UID is between 100 and 999,the user has root privilege. Am I right?

next is How do you say user can run interactive shell by reading /etc/passwd?

PS. I am parsing this files in python, I can implement the logic, I just don't know the how to find out root user and what is Interactive shell and how to find one.

11
  • 1
    One question per post please Feb 1, 2016 at 4:17
  • 2
    Also it's not enough to find all system accounts. Regular users with id 1000 and higher can run admin tasks with sudo, so technically they have root privileges Feb 1, 2016 at 4:19
  • 1
    What's the main premise of the question? Also split out your questions - one question per posted quesiton
    – Thomas Ward
    Feb 1, 2016 at 4:20
  • 1
    Sounds like a duplicate of this one: askubuntu.com/questions/611584/how-could-i-list-all-super-users
    – kos
    Feb 1, 2016 at 4:36
  • 1
    In any case as it has been said already really you should split the second question into a new in question, please do that.
    – kos
    Feb 1, 2016 at 4:39

2 Answers 2

2

There is two types of accounts, system and regular user. System accounts belong to services and daemons, such as lightdm, dnsmasq, etc.Typically you cannot login into those accounts (although there are ways).

Regular users, such as your account or other people accounts, can login and interact with the OS through shell (could be bash, ksh, mksh, csh, or graphical shell such as Gnome or Unity).

System accounts range from 100 to 999 by default. There exists one special case, nobody , who has ID of 65534 (That's the max UID number ). On my system for instance dnsmasq it runs dnsmasq service.

Regular user accounts have UID range from 1000 to 65533. Those users can login, unless their password is disabled or their entry in /etc/passwd has shell set to /usr/sbin/nologin, or prevented in some other way. These users can have root privilege if they belong to sudo group.

So if you want to find users who have sudo privilege you need to parse /etc/group file. Here's mine:

$ awk '/sudo/' /etc/group                                      
sudo:x:27:xieerqi,testuser

To get just the users, use : as separator and print 4th field.

$ awk -F':' '/sudo/{print $4}' /etc/group                      
xieerqi,testuser

In python this is done as so:

>>> with open("/etc/group") as file:
...    for lines in file:
...       if lines.__contains__("sudo"):
...          print lines.split(":")[3]

Here's even more interesting approach. How about if we want to take all the sudo users and see if they have a shell set up in /etc/passwd ?

$ awk -F':' '/sudo/{gsub(/\,/,"\n");print $4 }' /etc/group | xargs -I {} grep '^{}\:.*' /etc/passwd               
xieerqi:x:1000:1000:xieerqi,,,:/home/xieerqi:/bin/mksh
testuser:x:1001:1001:,,,:/home/testuser:/bin/bash
5
  • Always welcome ! Welcome to the site, and feel free to ask more questions Feb 1, 2016 at 4:44
  • I am splitting question, in separate question. Please do answer that too. Feb 1, 2016 at 4:44
  • I am parsing this files in python, I can implement the logic, I just don't know the how to find out root user and what is Interactive shell and how to find one. Feb 1, 2016 at 4:50
  • So . . .python, huh ? Let me think how that can be done . . . Feb 1, 2016 at 4:51
  • import grp; grp.getgrnam('sudo').gr_mem
    – Germar
    Feb 1, 2016 at 5:51
0

In python this would be done like

import grp
import pwd
print([x for x in grp.getgrnam('sudo').gr_mem if pwd.getpwnam(x).pw_shell not in ('/bin/false', '/bin/nologin')])

Where grp.getgrnam('sudo').gr_mem would return all group members of group sudo and pwd.getpwnam(USER).pw_shell returns the users shell from /etc/passwd.


But only group membership in sudo is not the only way to become root. Your users could also have individual entries in /etc/sudoers which would give them root permissions. So you'd need to parse /etc/sudoers as well.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .