Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to prevent users with sudoer access from using sudo to execute passwd (and thus changing the root password).

Is this possible? If so, how can it be accomplished?

share|improve this question
add comment

1 Answer

You basically cannot forbid users from executing a particular command, if they're still allowed to execute all other commands – they could copy passwd to really-not-passwd-i-promise and execute that.

If you want to stop sudoers from changing root's password – or somebody else's password – you cannot prevent that either; they can manually edit /etc/shadow as long as they have root privileges using sudo.

(This could be achieved by e.g. using Kerberos or LDAP for authentication – that way nobody could change another user's password – but still nothing can prevent sudoers from simply breaking configuration or something like that.)

Basically, don't give full sudo rights to people you do not trust. Forbidding a single command and allowing all others cannot be done.

share|improve this answer
1  
+1 - The only option I could think of to allow some, but not all, sudo rights would be to create a user group with access to some of the root abilities. But @PaulDC, there should be little reason why other users outside of the sysadmin should have root privs (especially questionable users). Do some research for user groups and visudo. It may get you the closest possible (but you need to define each specific thing that can be done to limit it, and avoid editors like vim/emacs since that would allow file editing with admin rights). –  nerdwaller Apr 5 '13 at 3:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.