From: belal@sco.COM (Bela Lubkin)
Newsgroups: biz.sco.general
Subject: Re: How to allow a user "shutdown"
Date: 25 Jul 92 00:02:09 GMT
Organization: [resent by] The SCOGEN gateway and Propagation Society
Resent-From: mmdf@xenitec.on.ca
Submit-To: scogen@xenitec.on.ca
Precedence: bulk

Here are two documents from SCO's support database: one for UNIX, one
for XENIX.  Note, by the way, that both of these are rather old and
crusty.  The UNIX one should apply to 3.2v4 and ODT 2.0, but you'd
probably be better off using the shutdown subsystem authorization
(mentioned at the end).  The XENIX one does apply to XENIX 2.3.x, I
believe, even though it doesn't mention them.

Both documents talk about making a *user* called shutdown, rather than
giving out the ability to run shutdown to multiple other users.  UNIX
provides for that ability; XENIX doesn't, and it wouldn't be trivial to
do.  shutdown is a shell script (can't have suid bit).  Users could run
an suid copy of haltsys or reboot, but that is not the same thing!  The
UNIX versions of haltsys/reboot are also shell scripts; but you can do
what you want with asroot and/or the shutdown authorization.

>Bela Lubkin<  Support engineer, The Santa Cruz Operation

=============================================================================

Creating a user that shuts down the system in SCO UNIX System V/386.

RELEASE:  SCO UNIX System V/386 Release 3.2 Operating System Version 2.0 
	  SCO Open Desktop 1.1.0 or 1.1.1 

PROBLEM:  How do I create a user that shuts down the system in SCO UNIX.

SOLUTION: Support Level Supplement (SLS) unx257 must be installed. 

    1.  Log in as root in System Maintenance mode.

    2.  Using sysadmsh Accounts->User->Create, create a user with the
	name "shutdown":

		Select 'NO' to Modify defaults?
                Assign a password to shutdown

    3.	Create a file /usr/shutdown/<filename> with the following line:

               	/tcb/bin/asroot shutdown  -g0 -y                        

       	The shutdown time option (0 in the example above) may be whatever 
        you choose.  Change the permissions and owner as follows:
             
                chmod 700 <filename>
                chown shutdown <filename> 

    4.  Using sysadmsh Accounts->User->Examine, select "Identity". 
	Change the login shell to "/usr/shutdown/<filename>".
        Select <Keep> Home directory.
	Save the changes.

	Then select "Privileges".
        Choose "Subsystem".
	Then select "Specify".
        Add the "shutdown" authorization.

    5. If you want shutdown to be automatic, add the following line
       to the file /etc/default/su.

       ASROOTPW=NO

       NOTE: The file /etc/default/su may need to be created.  If this file 
	     is not amended, the shutdown user will be prompted for their 
	     password a second time, when they log in.

    6.  A user may now shut down the system by logging in as "shutdown".

************************************************************************


    The "shutdown" authorization allows an ordinary user with this 
    authorization to shut down the machine using the following command:

        /tcb/bin/asroot shutdown -y -g0

    This may be preferable to the special account created above.

=============================================================================

How do I create a user that shuts down the system under SCO XENIX? 

RELEASE:  SCO XENIX System V Operating System Generic 

A:  Here are the steps:

    1.  Log in as root.

    2.  First create a user with name shutdown, with or 
    without a password depending on your security needs
    (if you do not give this user a password, anyone will
    be able to shut the system down by typing shutdown at
    a system prompt), and restricted shell.

    3.  Then, edit the /etc/passwd file (be very careful,
    first make a backup copy of the file).  The only line
    you want to change is the one that begins with 
    'shutdown'.  You only need to change the numbers
    which correspond to owner and group id to 0 so that the
    user has root permission.  Do not change anything else
    in the file or add spaces anywhere.  The line will look 
    something like this (the example below does not have a
    password.  If you have give the shutdown user a passwd 
    it will appear in encrypted form between the first two 
    colons):
     
                +---+-------+---(these will be different
                |   |       |   in your file)
     Before:    V   V       V
     shutdown::555:777:Some Comment:/usr/shutdown:/bin/rsh
     After:
     shutdown::0:0:Some Comment:/usr/shutdown:/bin/rsh

     At this point there are two methods to use. Either have the
     /etc/passwd file execute the shutdown command by changing the
     last entry to /etc/shutdown or /bin/sh -c /etc/shutdown (instead
     of /bin/rsh in the above example) OR execute the shutdown command
     in the .profile by doing the following:

     4.  Add the following line to the end of the file .profile 
     in the directory /usr/shutdown:
  
     exec /etc/shutdown 
                          ^
     (Shutdown may be invoked with an option)

     --------------------------------------------------------------
     The following may not apply depending on your release of Xenix.

     5.  You must alter the /etc/shutdown shell script which 
     gives permission for this user to run it.  The way you alter your
     shell script differs depending on whether you have 2.1 or 2.2 
     release of SCO Xenix.  The first example is 2.1, the second 2.2. 

     The part of your file which you will change is right after the 
     comments at the beginning.  Following is what this part of your 
     file will look like before and after you add the line for
     Xenix 2.1.
     Before:

     case `who am i` in
     root*console*): OK;;
     ""): single user mode OK too;;

     After:

     case `who am i` in
     root*console*): OK;;
     shutdown*) ;;  
     ""): single user mode OK too;;

     For 2.2 Xenix:

     Before:

     set -- `who am i`
     case $1 in
     root|sysadm|"") : OK

     After:

     set -- `who am i`
     case $1 in 
     root|sysadm|shutdown|"") : OK

     6.  A user may now shut down the system merely by logging in as 
     'shutdown'.