Linux Restrict Execution of /usr/sbin/userhelper to Console Users

Posted on in Categories , , , , , , , , last updated October 3, 2009

I‘m CentOS Linux version 5.x user and I’d like to restrict execution of /usr/sbin/userhelper to console users only in xusers group?

/usr/sbin/userhelper is a helper interface to pam. From the man page:

This program provides a basic interface to change a user’s password, gecos information, and shell. The main difference between this program and its traditional equivalents is that prompts are written to standard out to make it easy for a GUI wrapper to interface to it as a child process.

Simply run the following command so that users in xusers group can use /usr/sbin/userhelper
groupadd xusers
usermod -aG xusers user1
usermod -aG xusers user2
usermod -aG xusers userN
chgrp xusers /usr/sbin/userhelper
chmod 4710 /usr/sbin/userhelper

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

Leave a Comment