sudoers file and passwd only for selected group

Question

I have 3 users in "production" group: John, Steve and Bob. In "sales" group are: Sam and Jack.

Now, I would like to give John permition to change passwords of all users but only in "production" group, so he will be unable to make any changes to Sam and Jack.

In my /etc/sudoers file I have alias for all users in "production" group:

User_Alias  PRODUCTION = %production    

And the problem is I have no idea how to write this:

john ALL =(root) /usr/bin/passwd steve, (root) /usr/bin/passwd bob, (root) /usr/bin/passwd jack    

... using my PRODUCTION alias, so if there is someone new added to this group, there will be no need to add him manually to sudoers file too.

I've tried something like this in many variations:

john ALL =(root) /usr/bin/passwd PRODUCTION    

but it doesn't work and at this moment I have no more ideas.

I will appreciate any clues, thanks a lot!

Answer 1

This is too complicated for sudoers.

You have to write a script which checks whether the user belongs to this group and calls passwd if so.

sudoers must then be configured so that john can run this script as root. Of course, the path to this script must be writable only for root.

#! /bin/bash

group="groupname"

test $# -ne 1 && exit 2

user="$1"

if id "$user" | grep -qF "(${group})"; then
        echo passwd "$user"
else
        echo "User '${user}' is not in group '${group}'."
fi

called as

./testscript username

Answer 2

I know this query is 2 yrs old, but I did find an answer that does not involve a script.

You should use visudo to update the /etc/sudoers file. See sodoers(5) man page. You should see an example that you should be able to leverage pretty easily:

    USER HOST = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

The user(s) defined as USER is allowed to change anyone's password except for root on the HOST machine(s). Note that this assumes passwd(1) does not take multiple usernames on the command line.