&& How to Make root User
Into a RoleSystem Administration Guide: Security Services
How to Make root User
Into a Role
This procedure shows how to change root from a login
user to a role. When you complete this procedure, you can no longer directly
log in to the system as root, except in single-user mode.
You must be assigned the root role and su to root.
By changing the root user into a role, you prevent
anonymous root login. Because a user must log in and then assume the root role, the user's login
ID is provided to the auditing service and is in the sulog file.
In this procedure, you create a local user and assign the root role
to the user. To prevent users from assuming the role, see .
Before You BeginYou cannot perform this procedure when you are directly logged in as root. You must log in as yourself, then su to root.
As a regular user, log in to the target system.
Assume the Primary Administrator role, or become superuser.
The Primary Administrator role includes the Primary Administrator profile.
To create the role and assign the role to a user, see .
Create a local user
who can assume the root role.
For safety, at
least one local user should be assigned the root role.
$ useradd -c comment -u uid -d homedir username
-c comment
Is the comment that describes the user.
-d homedir
Is the home directory of the user. This directory should be
on the local system.
Is the user identification number.
Is the name of the new local user.
# useradd -c "JDoe's local account" -u 123 -d /export/home1 jdoe-local
Give the user a password.
# passwd -r files jdoe-local
New Password:
&Type password&
Re-enter new Password: &Retype password&
passwd: password successfully changed for jdoe-local
Make sure that you are not logged in as root.
May 24 13:51
May 24 13:51
May 24 13:51
May 24 13:51
Change root user into a role.
# usermod -K type=role root
Verify that root is a role.
The root entry in the user_attr file should appear
similar to the following:
# grep root /etc/user_attr
root::::type=auths=solaris.*,solaris.profiles=...
Assign the root role to your local account.
# usermod -R root jdoe-local
Caution & If you do not assign the root role to a
user, no one can become superuser, except in single-user mode. You must type
a root password to enter single-user mode.
Configure the name service to return in case of failure.
Open a new terminal window and assume the root role.
% su - jdoe-local
Enter password:
&Type jdoe-local password&
% su - root
Enter password:
&Type root password&
Edit the nsswitch.conf file.
example, the following entries in the nsswitch.conf file
would enable the name service to return.
files nis [TRYAGAIN=0 UNAVAIL=return NOTFOUND=return]
files nis [TRYAGAIN=0 UNAVAIL=return NOTFOUND=return]
(Optional) Assign the root role
to selected user accounts in the name service.
For the procedure,
Example&9&8
Preventing the root Role From Being Used to Configure
a SystemIn this example, site security policy requires that several discrete
roles configure the system. These discrete roles have been created and tested.
To prevent the root account from being used to configure
the system, the security administrator changes root into
a role, but does not assign the role. The root role retains
a password to enter the system in single-user mode.
First, the administrator verifies that root is not
an assigned role.
jdoe-local
% su - root
Password: a!2@3#4$5%6^7
# grep roles /etc/user_attr
jdoe-local::::type=roles=secadmin
kdoe-local::::type=roles=sysadmin
Still in the root account, the administrator changes root into a role.
# usermod -K type=role root
Then, the administrator verifies the change in the root entry
in the user_attr file.
# grep root /etc/user_attr
root::::type=role;auths=solaris.*,solaris.profiles=...
Example&9&9
Changing the root Role Back Into the root User
this example, the administrator is decommissioning a system and wants to log
in to the desktop as superuser. The system has been removed from the network.
First, the administrator assumes the root role to
remove all root role assignments.
jdoe-local
% su - root
Password: a!2@3#4$5%6^7
# grep roles /etc/user_attr
jdoe-local::::type=roles=root
kdoe-local::::type=roles=root
# usermod -R "" jdoe-local
# usermod -R "" kdoe-local
# grep roles /etc/user_attr
Still in the root role, the administrator changes root into a user.
# rolemod -K type=normal root
Then, the administrator verifies the change in the root entry
in the user_attr file.
# grep root /etc/user_attr
root::::type=normal;auths=solaris.*,solaris.profiles=...
Troubleshooting
In a desktop
environment, you cannot directly log in as root when root is a role. A diagnostic message indicates that root is
a role on your system. If you do not have a local account that can assume
the root role, create one. As root,
log in to the system in single-user mode, create a local user account, and
assign the root role to the new account. Then, log in as
the new user and assume the root role.
No one can
become superuser if you change the root user into a role
and fail to make one of the following assignments:
Assign the root role to a valid user.
Assign a rights profile that is equivalent to root's
rights profile to a valid user. The Primary Administrator profile is an equivalent
rights profile for root capabilities.
Create a role that has the capabilities of root and
assign the role to a valid user. A role that is assigned the Primary Administrator
profile is equivalent to the root role.I'm using Hibernate Spatial with Spring. I have the following spatial query:
@SuppressWarnings(&unchecked&)
public List&Admin& getAffectedAdmins(String wktFilter) {
WKTReader fromText = new WKTReader();
Geometry filter =
filter = fromText.read(wktFilter);
System.out.println(&Filter = & + filter);
} catch (ParseException e) {
e.printStackTrace();
hibernateTemplate = new HibernateTemplate(sessionFactory);
List&Admin& admins = new ArrayList&Admin&();
(List&Admin&) hibernateTemplate.findByCriteria(
DetachedCriteria.forClass(Admin.class)
.add(SpatialRestrictions.eq(&geom&, filter)));
The application compiles and installs successfully. I'm using Tomcat
for my tests. However, when I call the above method, the following
exception is thrown:
org.springframework.web.util.NestedServletException: Handler
nested exception is java.lang.NoSuchMethodError:
org.hibernate.criterion.CriteriaQuery.getFactory()Lorg/hibernate/engine/spi/SessionFactoryI
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:972)
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778)
javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
root cause
java.lang.NoSuchMethodError:
org.hibernate.criterion.CriteriaQuery.getFactory()Lorg/hibernate/engine/spi/SessionFactoryI
org.hibernate.spatial.criterion.SpatialRelateExpression.toSqlString(SpatialRelateExpression.java:93)
org.hibernate.loader.criteria.CriteriaQueryTranslator.getWhereCondition(CriteriaQueryTranslator.java:380)
org.hibernate.loader.criteria.CriteriaJoinWalker.&init&(CriteriaJoinWalker.java:113)
org.hibernate.loader.criteria.CriteriaJoinWalker.&init&(CriteriaJoinWalker.java:82)
org.hibernate.loader.criteria.CriteriaLoader.&init&(CriteriaLoader.java:92)
org.hibernate.impl.SessionImpl.list(SessionImpl.java:1697)
org.hibernate.impl.CriteriaImpl.list(CriteriaImpl.java:347)
org.springframework.orm.hibernate3.HibernateTemplate$36.doInHibernate(HibernateTemplate.java:1056)
org.springframework.orm.hibernate3.HibernateTemplate$36.doInHibernate(HibernateTemplate.java:1)
org.springframework.orm.hibernate3.HibernateTemplate.doExecute(HibernateTemplate.java:406)
org.springframework.orm.hibernate3.HibernateTemplate.executeWithNativeSession(HibernateTemplate.java:374)
org.springframework.orm.hibernate3.HibernateTemplate.findByCriteria(HibernateTemplate.java:1046)
org.springframework.orm.hibernate3.HibernateTemplate.findByCriteria(HibernateTemplate.java:1039)
com.populationexplorer.dao.impl.PEDAOImpl.getAffectedAdmins(PEDAOImpl.java:43)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
java.lang.reflect.Method.invoke(Method.java:597)
org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:319)
org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:110)
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
$Proxy16.getAffectedAdmins(Unknown Source)
com.populationexplorer.controller.PEWSController.getCapabilities(PEWSController.java:28)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
java.lang.reflect.Method.invoke(Method.java:597)
org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:213)
org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:126)
org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:96)
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:617)
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:578)
org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778)
javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
Thanks in advance.
Kind Regards,
Okello Nelson.
Previous message:
Next message:
Messages sorted by:USERS.SU Server
- AutoMotoSport Land
- Incredible adventures around the world and much more
- Evlakhov Journalistic Print Group山海经之赤影传说
和巧虎学数学
年兽大作战
我是杜拉拉
汪汪队立大功
给您影院般的“极致”体验
版本：5.59.}