0

I want to parse /etc/passwd file to find out if the user has root privilege and can run interactive shell.

according to

UID 100-999 are reserved by system for administrative and system accounts/groups

what I understood is if the UID is between 100 and 999,the user has root privilege. Am I right?

next is How do you say user can run interactive shell by reading /etc/passwd?

PS. I am parsing this files in python, I can implement the logic, I just don't know the how to find out root user and what is Interactive shell and how to find one.

  • 1
    One question per post please – Sergiy Kolodyazhnyy Feb 1 '16 at 4:17
  • 2
    Also it's not enough to find all system accounts. Regular users with id 1000 and higher can run admin tasks with sudo, so technically they have root privileges – Sergiy Kolodyazhnyy Feb 1 '16 at 4:19
  • 1
    What's the main premise of the question? Also split out your questions - one question per posted quesiton – Thomas Ward Feb 1 '16 at 4:20
  • 1
    Sounds like a duplicate of this one: askubuntu.com/questions/611584/how-could-i-list-all-super-users – kos Feb 1 '16 at 4:36
  • 1
    In any case as it has been said already really you should split the second question into a new in question, please do that. – kos Feb 1 '16 at 4:39
2

There is two types of accounts, system and regular user. System accounts belong to services and daemons, such as lightdm, dnsmasq, etc.Typically you cannot login into those accounts (although there are ways).

Regular users, such as your account or other people accounts, can login and interact with the OS through shell (could be bash, ksh, mksh, csh, or graphical shell such as Gnome or Unity).

System accounts range from 100 to 999 by default. There exists one special case, nobody , who has ID of 65534 (That's the max UID number ). On my system for instance dnsmasq it runs dnsmasq service.

Regular user accounts have UID range from 1000 to 65533. Those users can login, unless their password is disabled or their entry in /etc/passwd has shell set to /usr/sbin/nologin, or prevented in some other way. These users can have root privilege if they belong to sudo group.

So if you want to find users who have sudo privilege you need to parse /etc/group file. Here's mine:

$ awk '/sudo/' /etc/group                                      
sudo:x:27:xieerqi,testuser

To get just the users, use : as separator and print 4th field.

$ awk -F':' '/sudo/{print $4}' /etc/group                      
xieerqi,testuser

In python this is done as so:

>>> with open("/etc/group") as file:
...    for lines in file:
...       if lines.__contains__("sudo"):
...          print lines.split(":")[3]

Here's even more interesting approach. How about if we want to take all the sudo users and see if they have a shell set up in /etc/passwd ?

$ awk -F':' '/sudo/{gsub(/\,/,"\n");print $4 }' /etc/group | xargs -I {} grep '^{}\:.*' /etc/passwd               
xieerqi:x:1000:1000:xieerqi,,,:/home/xieerqi:/bin/mksh
testuser:x:1001:1001:,,,:/home/testuser:/bin/bash
| improve this answer | |
  • Always welcome ! Welcome to the site, and feel free to ask more questions – Sergiy Kolodyazhnyy Feb 1 '16 at 4:44
  • I am splitting question, in separate question. Please do answer that too. – Kishor Pawar Feb 1 '16 at 4:44
  • I am parsing this files in python, I can implement the logic, I just don't know the how to find out root user and what is Interactive shell and how to find one. – Kishor Pawar Feb 1 '16 at 4:50
  • So . . .python, huh ? Let me think how that can be done . . . – Sergiy Kolodyazhnyy Feb 1 '16 at 4:51
  • import grp; grp.getgrnam('sudo').gr_mem – Germar Feb 1 '16 at 5:51
0

In python this would be done like

import grp
import pwd
print([x for x in grp.getgrnam('sudo').gr_mem if pwd.getpwnam(x).pw_shell not in ('/bin/false', '/bin/nologin')])

Where grp.getgrnam('sudo').gr_mem would return all group members of group sudo and pwd.getpwnam(USER).pw_shell returns the users shell from /etc/passwd.


But only group membership in sudo is not the only way to become root. Your users could also have individual entries in /etc/sudoers which would give them root permissions. So you'd need to parse /etc/sudoers as well.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.