Linux Tip: Replacing GKSUDO for CENTOS users

One of the annoying things about maintaining CENTOS installations is performing system maintenance as the super user from the command line. Don’t get me wrong but I was programming before graphical interfaces(BGI). The command line is a good and trusty way to perform maintenance. As long as everything works you can get by with a minimum of memorization. Since most of us live in an after graphical interfaces(AGI) world and we do not practice our Linux command line knowledge on a daily basis, we quickly get rusty on the tricks of the trade and yearn for an easier way. Something with a fast learning curve. This is precisely why we have graphical interfaces.

For reasons I did not understand until today CENTOS does not make it easy to run graphical programs as the super user, such as nautilius and gedit. Ubuntu offers a fairly simple way to create menu items to start graphical programs as a super user, gksudo.  CENTOS does not offer this utility in either Version 4 or 5. A similar utility, kdesu, was offered in CENTOS Version 4 but is not offered in CENTOS 5. Opening a terminal window and running SUDO is an pretty clumsy option so I was pretty sure that there probably was a better way! I wanted a menu item like the other system maintenance menu items that would authenticate me before running an application as a super user.

Today I found the answer. Matt Hansen wrote a tip how to “How to run a program from GNOME menu with root privileges ” back in 2004. The tip uses a utility called consolehelper. You have to create a couple of configuration files but the whole process can be completed in about five minutes. It is interesting that today was the first time I found a reference that claims consolehelper is the “proper” way to solve the “missing” gksudo problem.

4 thoughts on “Linux Tip: Replacing GKSUDO for CENTOS users”

  1. Well, this does not really solve the problem. As gksudo uses sudo which asks for my password, not the root password and grants permission based on the sudo configs. So really this is no solution at all, why would anyone recommend this!!!

  2. @Mike is right. The post doesn’t really solve the problem, as the permission window that pops up is asking for the root password, not *your* login credentials like gksudo does. Far as I know, if you want a grapical prompt that ultimately checks the suders file, I think you’re SOL. However, I found an old e-mail thread on redhat.com that allows you to make console helper work a little more *like* sudo. Check http://www.redhat.com/archives/fedora-desktop-list/2005-March/msg00002.html for the trick. What it boils down to is you can add UGROUPS to a given application’s security configuration (look in /etc/security/console.apps for those). You give this parameter a list of groups and members of these groups will be will be prompted for *their* credentials, then be allowed to run the app as if they were the user specified in the USER parameter (which can be root, webmaster, whatever).

    Now, combine this trick with beesu, a consolehelper-aware application very similar to gksudo, and you have a pretty sudoer-like system. The big requirement will be specifying a group for these people with sudoers-style persmissions, maybe call it “sudoers”, and add all would-be sudoers to it. Then, make beesu’s config file (/etc/security/console.apps/beesu) look like this:

    USER=root
    PROGRAM=/usr/sbin/beesu
    SESSION=true
    UGROUPS=sudoers

    Incidentally, beesu has its own configuration files that let you make the permissions more fine-grained. I’ve never really looked at it when I found this trick worked, but others might.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.