Please do not ask why, but is it possible to do it?

p/s: I know it's not a good thing, let's just say someone from the top management who is computer illiterate want some sort of control over the server.

  • 8
    Don't we have an 'evil' tag? :P – axel_c Aug 23 '10 at 9:45
  • 4
    Can't resist. Why? – KeithB Aug 23 '10 at 13:12
  • giving a user the right to change the root password is the same as giving them full root access, so why bother giving them "only" password-changing access? – user601 Aug 23 '10 at 16:35
  • 1
    He probably heard the story about the San Francisco network admin. It's not that stupid, if he can be trusted to use this power only in such an emergency. – starblue Aug 24 '10 at 20:11
  • 1
    en.wikipedia.org/wiki/Terry_Childs – starblue Oct 10 '10 at 17:38

Don't do that... you can either give them root's password or you could execute sudo passwd root (this assumes that sudo is set to use the users password or no password, and that passwd is a command that sudo has authorized to be run by that user).

| improve this answer | |

sudo is the swiss-army knife of customized permissions. You could ask the user to run

sudo /usr/bin/passwd root

To see how this might be enabled, here's a related example from the sudoers(5) manpage.

pete           HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

The user pete is allowed to change anyone's password except for root on the 
HPPA machines.  Note that this assumes passwd(1) does not take multiple 
usernames on the command line.

You'll have to invert the logic to achieve your ends, of course. So, you would execute the visudo, and add a line like

user ALL = /usr/bin/passwd root

to /etc/sudoers.

| improve this answer | |

Maybe you can add this line to the sudoer file (using visudo), replacing phunehehe with the username.

phunehehe localhost = NOPASSWD: /usr/bin/passwd

I don't know if that breaks your condition of a "normal user", though, because after that he/she has so much power.

EDIT: as per xenoterracide's comment :)

| improve this answer | |
  • 4
    I don't know why you'd think he'd need this. He didn't ask you to make it passwordless. why reduce the security of the system more than necessary if you're doing anyting like this it should be user localhost = NOPASSWD: /usr/bin/passwd which would limit the security accesss to just that. – xenoterracide Aug 23 '10 at 13:03

Can't he use run level 1 to change root password?

What I have in mind is

  1. Set grub password so that not every user can change the run level at boot time.
  2. This password is given to the normal user who might need to change root password in future.
  3. Now if needs arise to change the root password, he can modify grub parameters at boot time. Press 'a', give grub password and then give 1, so that machine boots into run level 1.
  4. Once in run level 1, he can change root password.

The obvious disadvantage of this procedure is that machine has to be rebooted and while its in run level 1, it will be offline.

Kindly mention the flaws that you find in this procedure.

| improve this answer | |

If you don't trust the owner of the root account then there's probably no way to prevent that root user from removing this special permission. If you do trust the root user then just ask him for the current password.

| improve this answer | |

If your system used pam_tcb (tcb - the alternative to /etc/shadow) (and hence there were users' password files per user), you could also achieve what you want by managing file permissions and groups (say, add this user to the group that you make own the password file for root).

In this case, I don't see any principal differences in the results as compared to the sudo-solution (if you are ready to trust sudo, of course), because you are anyway giving away the highest privilege to that user.

But in other cases, pam_tcb gives more flexibility and security: first, you ought not to trust sudo and passwd in that they won't let the user exploit the privileges in an unwanted way; second, less privileges must be given to users to achieve certain similar configurations (and no setUID-root programs are needed at all) -- see, e.g., the question for a similar thing: Reset [another] user's password without root .

| improve this answer | |

If you trust that user so that he has permission to change root password, it should be safe to give him the current root password in the first place.

| improve this answer | |

If that user has sudo access then sudo passwd root dose the work. If we don't have sudo access then it'll prompt for the password again. If we know the password the work can be done.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.