Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
1

I'd like to use a different password to elevate my user to sudo status than the password I use to login (either via GUI, shell, or SSH) to my account. Is this possible?

EDIT: Since setting the root password would allow login as root, this is not a good way to go. I'd prefer a user-specific sudo password, rather than a system-wide root password.

share|improve this question
1  
Can you elaborate on this -- why do you want to do this? – Doug Harris May 10 '12 at 17:48
I feel the question explains itself well enough, but the goal is to make login secure via lengthy, difficult passwords and then to use a different password for sudo access, so that compromising a user's account does not automatically provide sudo access. – Richard May 10 '12 at 17:52
I've heard it's possible to do sudo through rsa/dsa keys, which can have any passphrase you want. – Rob May 10 '12 at 18:37

3 Answers

up vote 1 down vote

from man sudoers:

rootpw          If set, sudo will prompt for the root password instead of the
                password of the invoking user.  This flag is off by default.

runaspw         If set, sudo will prompt for the password of the user defined
                by the runas_default option (defaults to root) instead of the
                password of the invoking user.  This flag is off by default.

Or you could just ban password based logins via ssh completely. Require a passphrase encrypted key for remote login. Then you are free to use the password for sudo. The relevant option is

from man sshd_config

 PasswordAuthentication
         Specifies whether password authentication is allowed.  The default
         is “yes”.
share|improve this answer
Thanks for your help, Chas. Owens. I'm afraid a side-effect of your solution is that the root account would have a password and it would therefore be possible to login as root, which is not a door which I wish to leave open. I'd prefer a user-specific sudo password, rather than a system-wide root password. – Richard May 10 '12 at 18:00
You can disable root login from sshd_config as well – Rob May 10 '12 at 18:35
up vote 0 down vote

are you looking for this instead in sudoers man?

   targetpw        If set, sudo will prompt for the password of the user
                   specified by the -u option (defaults to root) instead of the
                   password of the invoking user.
share|improve this answer
Thanks for your help, johnshen64. I'm afraid a side-effect of your solution is that the root account would have a password and it would therefore be possible to login as root, which is not a door which I wish to leave open. I'd prefer a user-specific sudo password, rather than a system-wide root password. – Richard May 10 '12 at 18:00
that user does not have to be root user, it just defaults to root if you do not specify it. you can experiment it to see if it would for you. unix is quite open and if these still do not work for you, you can even write a wrapper script or even modify sudo (if you know c) to do exactly what you want. – johnshen64 May 10 '12 at 18:02
@johnshen64 I think he is objecting to the fact that the same password would be used for all users. – Chas. Owens May 10 '12 at 18:10
I see, but an admin user can be created for each user, say ${USER}foradmin, so that a user always specifies -u ${USER}foradmin, though to enforce that sudo still needs to be replaced by a custom script. – johnshen64 May 10 '12 at 18:13
up vote 0 down vote

How about disable password logon via SSH and allow public key logon where you can set your difficult to guess password. Then the local password can be shorter and used by sudo.

Other than that you will have to configure /etc/pam.d/sudo to use a different (or additional) module, at first glance pam_dialpass might allow what you need.

You could also configure LDAP configuration for one and local passwords for the other. It will all depend on how much changes you are able and willing to make, what modules are available etc.

share|improve this answer
Thanks for your help, Bram. Your first suggestion would work, save that public key authentication can be prohibitive to work with, unless you've come prepared to transfer key files around. – Richard May 10 '12 at 20:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.