I want to prevent users with sudoer access from using sudo
to execute passwd
(and thus changing the root password).
Is this possible? If so, how can it be accomplished?
You basically cannot forbid users from executing a particular command, if they're still allowed to execute all other commands – they could copy passwd
to really-not-passwd-i-promise
and execute that.
If you want to stop sudoers from changing root's password – or somebody else's password – you cannot prevent that either; they can manually edit /etc/shadow
as long as they have root privileges using sudo.
(This could be achieved by e.g. using Kerberos or LDAP for authentication – that way nobody could change another user's password – but still nothing can prevent sudoers from simply breaking configuration or something like that.)
Basically, don't give full sudo
rights to people you do not trust. Forbidding a single command and allowing all others cannot be done.
sudo
rights would be to create a user group with access to some of the root
abilities. But @PaulDC, there should be little reason why other users outside of the sysadmin should have root privs (especially questionable users). Do some research for user groups and visudo
. It may get you the closest possible (but you need to define each specific thing that can be done to limit it, and avoid editors like vim/emacs since that would allow file editing with admin rights).
Apr 5, 2013 at 3:03
It's very difficult to keep root user out of anything, but I believe you can do it with AppArmor.
The problem is, how would you set it up so that legitimate password changes can happen?
The trick might be to set up an AppArmor profile for sudo
that is inherited by all its children. This wouldn't affect users running passwd as themselves (to change their own password) and wouldn't affect users who enter root via su
.
However, I suspect you could circumvent that by copying, moving or renaming the sudo
binary, so you'd probably want to lock down passwd
write-access for all root processes, and then only ever change it using a live CD.
Of course, you also have to protect AppArmor itself from modification. :)
The best solution is probably too give sudo access only for specific commands and then only for commands that don't change the filesystem.
what about this:
edit /etc/sudoers file like below:
%wheel ALL=(ALL) ALL,!/usr/bin/* /etc/shadow,!/usr/bin/* /etc/sudoers\
,!/usr/bin/* /usr/bin/su,!/usr/bin/su,!/usr/sbin/visudo
then not any command accessible on these files and sudo su
too.
more
orless
)