Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This question already has an answer here:

I have a spare computer running as a small server doing various things, and I'd like to create another account for my cousin, so she can learn how do manage a server/run minecraft etc. I'd like to give her sudo privileges, but I was wondering if it's possible to disallow the use of the passwd utility, so she can't change my password (accidentally or intentionally)?

share|improve this question

marked as duplicate by strugee, Gilles, Braiam, Patrick, Ramesh Jun 17 at 0:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
This is practically impossible.if you grant her the permission of the root, then there's nothing you can do to prevent her from doing anything –  Networker Jun 16 at 22:42
1  
yes and no. You can configure sudo to disallow any command. But by allowing ALL others there will be a way around (e.g. vi /etc/shadow, or edit the sudo config file, or just break everthing ). However it can stop accidental usage, but what other command must you stop accidents on. –  richard Jun 16 at 22:42
1  
There's really no truly functional way, without going down the rabbit hole of all possible commands, since you have to exclude commands you don't want a user to run, rather than having to specifically include commands they are allowed to use. Meaning you have to prevent things like 'sudo bash' followed by 'passwd root', and if you disallow '/bin/bash', you have to catch 'sudo cp /bin/bash /tmp/bash ; sudo /tmp/bash'. –  Tim Kennedy Jun 16 at 22:43
add comment

2 Answers 2

Create a virtual machine, and have her log in to and use that. She can have complete root access within the VM, without affecting the host at all.

share|improve this answer
    
good suggestion! using a VM in this way would provide a good learning environment. –  Tim Kennedy Jun 16 at 22:51
add comment

If you give your cousin sudo privileges for execute any commands she has superuser privileges and can do anything with system. Right solutions - give sudo only for minimum required commands (for example vi /etc/init.d/minecraft оr /usr/bin/netstat). But remember, that many harmless commands (example less or find) allow to execute over commands.

If you don't want configure /etc/sudoers and just want protected from fool you can use some 'workaround':

  1. delete or move /usr/bin/passwd
  2. restore /etc/shadow from backup every 5 minutes by cron
  3. add in root .bachrc alias passwd='echo Nonono'
share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.