2

I want some of my users to be able to change their password with sudo command because at the time they log in, they are passwordless (ssh keys connection). My users have no password (and this is wanted), they can't sudo anything. Nevertheless, I want them to be able to do only one sudo command: sudo passwd $USER, so they can choose a password.

Here is the interesting parts of my sudoers file:

Defaults!/usr/bin/passwd    env_keep=SUDO_USER

%restrictedgroup ALL = NOPASSWD: /usr/bin/passwd $SUDO_USER

It doesn't work. How can I access the current SUDO_USER environnement variable in sudoers file?

EDIT: I have another important contraint in my context: I can't set a dummy password to every single users. It means they really can't change their password without sudo.

4
  • Why not just ask them to run passwd? You don't need sudo to change your own user's password.
    – terdon
    Jan 8, 2015 at 17:37
  • @terdon Yes, they need sudo. You can't change a password if you don't have one previously set, unless you are root (or sudo). That's why.
    – Gui-Don
    Jan 8, 2015 at 17:38
  • 1
    Ah, yes indeed. Would setting a silly password like pass and then having them change it be an option?
    – terdon
    Jan 8, 2015 at 17:40
  • I thought about that. But then, imagine I'm user3, and I log in first. I change my password, and because I know everybody's password (the silly pass), I can su. Of course, another solution is to make a different silly password to everyone, but this is my contraint: I can't do that easily in my context.
    – Gui-Don
    Jan 8, 2015 at 17:43

1 Answer 1

1

You could write a script (say /usr/local/bin/change-my-pass.sh):

#! /bin/sh    
passwd $SUDO_USER

And add that to the sudoers, then either tell your users (or give them a welcome message instructing them) to use that script.

1
  • Good solution, thanks. That solve my problem, but I'm still curious about a way to get environment variables in sudoers.
    – Gui-Don
    Jan 9, 2015 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .