2

Please do not ask why, but is it possible to do it?

p/s: I know it's not a good thing, let's just say someone from the top management who is computer illiterate want some sort of control over the server.

13
  • 8
    Don't we have an 'evil' tag? :P
    – axel_c
    Aug 23, 2010 at 9:45
  • 4
    Can't resist. Why?
    – KeithB
    Aug 23, 2010 at 13:12
  • giving a user the right to change the root password is the same as giving them full root access, so why bother giving them "only" password-changing access?
    – user601
    Aug 23, 2010 at 16:35
  • 1
    He probably heard the story about the San Francisco network admin. It's not that stupid, if he can be trusted to use this power only in such an emergency.
    – starblue
    Aug 24, 2010 at 20:11
  • 1
    en.wikipedia.org/wiki/Terry_Childs
    – starblue
    Oct 10, 2010 at 17:38

9 Answers 9

11

Don't do that... you can either give them root's password or you could execute sudo passwd root (this assumes that sudo is set to use the users password or no password, and that passwd is a command that sudo has authorized to be run by that user).

6

sudo is the swiss-army knife of customized permissions. You could ask the user to run

sudo /usr/bin/passwd root

To see how this might be enabled, here's a related example from the sudoers(5) manpage.

pete           HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

The user pete is allowed to change anyone's password except for root on the 
HPPA machines.  Note that this assumes passwd(1) does not take multiple 
usernames on the command line.

You'll have to invert the logic to achieve your ends, of course. So, you would execute the visudo, and add a line like

user ALL = /usr/bin/passwd root

to /etc/sudoers.

3

Maybe you can add this line to the sudoer file (using visudo), replacing phunehehe with the username.

phunehehe localhost = NOPASSWD: /usr/bin/passwd

I don't know if that breaks your condition of a "normal user", though, because after that he/she has so much power.

EDIT: as per xenoterracide's comment :)

1
  • 4
    I don't know why you'd think he'd need this. He didn't ask you to make it passwordless. why reduce the security of the system more than necessary if you're doing anyting like this it should be user localhost = NOPASSWD: /usr/bin/passwd which would limit the security accesss to just that. Aug 23, 2010 at 13:03
3

Can't he use run level 1 to change root password?

What I have in mind is

  1. Set grub password so that not every user can change the run level at boot time.
  2. This password is given to the normal user who might need to change root password in future.
  3. Now if needs arise to change the root password, he can modify grub parameters at boot time. Press 'a', give grub password and then give 1, so that machine boots into run level 1.
  4. Once in run level 1, he can change root password.

The obvious disadvantage of this procedure is that machine has to be rebooted and while its in run level 1, it will be offline.

Kindly mention the flaws that you find in this procedure.

3

If you don't trust the owner of the root account then there's probably no way to prevent that root user from removing this special permission. If you do trust the root user then just ask him for the current password.

3
  • What does “the owner of the root account” mean?  Are you suggesting that Ralph Oot might be given the username “root” (like in the current TV commercial, where the robot goes to a coffee shop, and the barista labels his cup “Rob Ott”)? (Believe it or not, I wrote this comment before I took a good look at your identicon image.) Jan 28 at 22:57
  • But you and I seem to be interpreting this question in totally different ways. You seem to believe that it’s about protecting the system against a rogue sysadmin who might change the root password and not tell anybody the new password. I believe that it’s about giving a manager immediate emergency access to root privilege at off-hours, without needing to bother anybody immediately. Jan 28 at 22:57
  • @g-man the only control you have is trust. If you trust your admins, they can set up a system that provides enough access control, like sharing the root password or adding a certain user to sudoers. But if you don't trust your admins there's nothing you can do to stop them from messing up your system. Hence just sharing the root password. 12 years later I would add "design your network with disaster recovery including losing access to certain accounts or systems" but ultimately there are some keys which need to be shared. Jan 29 at 23:52
3

If your system used pam_tcb (tcb - the alternative to /etc/shadow) (and hence there were users' password files per user), you could also achieve what you want by managing file permissions and groups (say, add this user to the group that you make own the password file for root).

In this case, I don't see any principal differences in the results as compared to the sudo-solution (if you are ready to trust sudo, of course), because you are anyway giving away the highest privilege to that user.

But in other cases, pam_tcb gives more flexibility and security: first, you ought not to trust sudo and passwd in that they won't let the user exploit the privileges in an unwanted way; second, less privileges must be given to users to achieve certain similar configurations (and no setUID-root programs are needed at all) -- see, e.g., the question for a similar thing: Reset [another] user's password without root .

1

If you trust that user so that he has permission to change root password, it should be safe to give him the current root password in the first place.

0

If that user has sudo access then sudo passwd root dose the work. If we don't have sudo access then it'll prompt for the password again. If we know the password the work can be done.

0

#Log in as root

 Login: root

#Modify your /etc/sudoers file to allow your 'NON-ROOT USERNAME' to run 'passwd' to change the root password #FIRST Change 'NON-ROOT USERNAME' to whatever your actual username is

echo 'Cmnd_Alias   PW      = /usr/bin/passwd [A-z]*' >> /etc/sudoers

echo 'NON-ROOT USERNAME    ALL     = (ALL) NOPASSWD: PW' >> /etc/sudoers

#Log in as your NON-ROOT USERNAME

Login: stan

#Make an alias for 'passwd' that will be 'sudo passwd'

echo 'alias passwd="sudo passwd"' >> .bashrc

#Log out

logout

#Log in as your NON-ROOT USERNAME

Login: stan

#Change roots password

passwd root
1
  • 1
    (1) This is wordy and unclear. (2) More importantly, it more-or-less duplicates a couple of old answers without explaining the differences.  Is your answer better than the others? If so, why? (3) Please don’t tell people to edit their /etc/sudoers file with echo and >>. Jan 28 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.