How to give a normal user permission to change root password

Question

Please do not ask why, but is it possible to do it?

p/s: I know it's not a good thing, let's just say someone from the top management who is computer illiterate want some sort of control over the server.

Answer 1

Don't do that... you can either give them root's password or you could execute sudo passwd root (this assumes that sudo is set to use the users password or no password, and that passwd is a command that sudo has authorized to be run by that user).

Answer 2

If that user has sudo access then sudo passwd root dose the work. If we don't have sudo access then it'll prompt for the password again. If we know the password the work can be done.

Answer 3

If your system used pam_tcb (tcb - the alternative to /etc/shadow) (and hence there were users' password files per user), you could also achieve what you want by managing file permissions and groups (say, add this user to the group that you make own the password file for root).

In this case, I don't see any principal differences in the results as compared to the sudo-solution (if you are ready to trust sudo, of course), because you are anyway giving away the highest privilege to that user.

But in other cases, pam_tcb gives more flexibility and security: first, you ought not to trust sudo and passwd in that they won't let the user exploit the privileges in an unwanted way; second, less privileges must be given to users to achieve certain similar configurations (and no setUID-root programs are needed at all) -- see, e.g., the question for a similar thing: Reset [another] user's password without root .

Answer 4

If you don't trust the owner of the root account then there's probably no way to prevent that root user from removing this special permission. If you do trust the root user then just ask him for the current password.

Answer 5

If you trust that user so that he has permission to change root password, it should be safe to give him the current root password in the first place.

Answer 6

Can't he use run level 1 to change root password?

What I have in mind is

1. Set grub password so that not every user can change the run level at boot time.
2. This password is given to the normal user who might need to change root password in future.
3. Now if needs arise to change the root password, he can modify grub parameters at boot time. Press 'a', give grub password and then give 1, so that machine boots into run level 1.
4. Once in run level 1, he can change root password.

The obvious disadvantage of this procedure is that machine has to be rebooted and while its in run level 1, it will be offline.

Kindly mention the flaws that you find in this procedure.

Answer 7

Maybe you can add this line to the sudoer file (using visudo), replacing phunehehe with the username.

phunehehe localhost = NOPASSWD: /usr/bin/passwd

I don't know if that breaks your condition of a "normal user", though, because after that he/she has so much power.

EDIT: as per xenoterracide's comment :)

Answer 8

sudo is the swiss-army knife of customized permissions. You could ask the user to run

sudo /usr/bin/passwd root

To see how this might be enabled, here's a related example from the sudoers(5) manpage.

pete           HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

The user pete is allowed to change anyone's password except for root on the 
HPPA machines.  Note that this assumes passwd(1) does not take multiple 
usernames on the command line.

You'll have to invert the logic to achieve your ends, of course. So, you would execute the visudo, and add a line like

user ALL = /usr/bin/passwd root

to /etc/sudoers.