I have a spare computer running as a small server doing various things, and I'd like to create another account for my cousin, so she can learn how do manage a server/run minecraft etc. I'd like to give her sudo privileges, but I was wondering if it's possible to disallow the use of the passwd utility, so she can't change my password (accidentally or intentionally)?
If you give your cousin sudo privileges for execute any commands she has superuser privileges and can do anything with system.
Right solutions - give sudo only for minimum required commands (for example
vi /etc/init.d/minecraft оr
/usr/bin/netstat). But remember, that many harmless commands (example
find) allow to execute over commands.
If you don't want configure /etc/sudoers and just want protected from fool you can use some 'workaround':
- delete or move /usr/bin/passwd
- restore /etc/shadow from backup every 5 minutes by cron
- add in root .bachrc
alias passwd='echo Nonono'