Switch user within cockpit session

[levi-jcbs]

Let me explain.

I have a server with some applications running under the specific user "app-user". And there are a couple of admins who should be able to administrate these applications - so they should be able to login to "app-user". But here comes the challenge: I (root) want to have full control on when which admin gets access or not. So here is what i did:

I created an own user account for each admin and put them all in the group "sudo-app-user". Then I disabled SSH Login for "app-user" and added the following rule in the sudoers file:

%sudo-app-user ALL=(app-user:app-user) ALL

In this way every admin account in the group "sudo-app-user" has access to app-user via sudo -iu app-user but cannot modify this access for themselves or other admins (because SSH is deactivated).

But:

This concept does unfortunately not work with cockpit. On the command line it's perfectly fine, but I haven't found a solution yet, how an admin user can login into cockpit and switch to "app-user" then (via sudo).

The "administrative access" feature works in a similar way, so I guess it should be possible to get my concept working with cockpit.

Has anyone a idea what I could do?

[martinpitt]

The more usual way to do this is to put all user accounts who should be allowed to access/admin that particular application into some app-admin (or app-users) group. But of course this depends on the nature of your "some applications" -- are these command line programs, D-Bus/unix socket/TCP services, or do you mean Cockpit pages? I.e. what are the resources that you want to control wiht the app-user user?

If you have a custom cockpit page, that could certainly run the sudo -iu app-user directly, as long as you extend the sudo rule to have NOPASSWD.

[levi-jcbs]

Hi Martin,

thanks for your answer! I want to use the podman and systemd-services module in cockpit as this app-user, but without logging in as this user (because SSH has to be disabled).

Do you think that's possible to archive somehow?

Levi

[martinpitt]

Sorry, no, that's not possible.