Is there a way I can grant a user or a group the permission to add/edit other users without the ability to alter anything else on the system? The idea is to give helpdesk agents the ability to grant access to others, but not perform any other system maintenance tasks.
No this is not possible using the Unix permissions models that are available via the
/etc/shadow files and
One method that I've seen used in the past, was to provide a frontend web application and/or program or shell script that that could execute via
sudo, but nothing else. This would provide them an API to perform a very narrow set of tasks through the "application", without giving them the actual capabilities through
sudo or general access to the