Create new linux account as a user without root access

Question

Is it possible to create a non-root Linux user account without being logged in as a root user and without using sudo?

Solution 1

Boot up into a system rescue CD. Or, if your root account is locked, boot to single-user mode (add 1 to the end of the boot command). Other than that, no. Could you imagine how insecure that would make a system?

Solution 2

It requires writing in some files. Which happen to be writable only by root. So use a setuid root binary like sudo or be root.

If the system is not being used, just mount the hard driver and edit manually the files you need, there should be binaries on the system to edit the password file/groups and such. I'm more a BSD user so I don't know the names but look for vipw/adduser/useradd/usermgmt/etc.

Are you sure you really need to do that? Managing user is part of the administrator's tasks, so root is the way to go. If someone else can modify system files, there's a security problem.

Solution 3

No. Generally speaking, the unix permission model only has two levels: root, and the rest. Root can do everything, and non-root users each have their own domain. Non-root users cannot create subdomains inside their security domain.

There is a way to create security domains as an ordinary user: run a virtual machine of some kind (VirtualBox, User Mode Linux, …). You can isolate applications running in the VM to your heart's content.

Comments

[Nils]

Why do you want to do this - what is your need?

[Simone]

I don't see any security threat in that. I just want to create an user account with the same privilege I have in my account while I'm logged with my account

[Michael Mrozek]

@Simone You could make dozens of accounts so it's hard for the admin to kick you off the system. Or make a second account and store all your illegal files there. Or just make new accounts to get around per-user restrictions like disk quotas

[Karlson]

@Simone A comment like this is likely to get you fired in any shop that actually has computer systems helping you make money.

[Kevin]

@Nils Yes, but not the root of his system. My understanding of runlevel 1 is that it requires a password if and only if root has one, but it's possible I'm mistaken. And yes, the boot menu should be protected, but we all know that's not always going to be the case.