1

I add line to sudoers:

user1 ALL= EXEC: PASSWD: /usr/bin/passwd user1

and when I use "sudo passwd user1" simple password is applied:

Password: 
New password: 
BAD PASSWORD: it is too short
BAD PASSWORD: is too simple
Retype new password: 
passwd: password updated successfully

How can I turn off forced change password by root?

-rwsr-x--- root root /usr/bin/passwd.shadow

So user1 can run passwd only as root. But I need to allow user1 change passwd for user1 and user2. And user2 should change passwd only for user2. I use sudoers for this:

user1 ALL= EXEC: PASSWD: /usr/bin/passwd user1
user1 ALL= EXEC: PASSWD: /usr/bin/passwd user2
user2 ALL= EXEC: PASSWD: /usr/bin/passwd user2
  • can you edit the post with the result of sudo -u user1 passwd user1 ? as I see it, the first password ask is by sudo to go from current user to root (thus the line user1 .. is not applied), then as you are changing password as root, old password is not asked, and you can enforce low quality password. – Archemar Dec 25 '17 at 10:41
  • and on a side note, user1 didn't need sudo to change password. – Archemar Dec 25 '17 at 10:43
  • It is restricted run passwd from user1. – TheFdu4 Dec 25 '17 at 11:26
1

Note that the command you're running with sudo is /usr/bin/passwd, not /usr/bin/passwd.shadow. It is not immediately obvious why passwd.shadow is mentioned at all: it is possible that passwd.shadow is an auxilliary command that is used by the main passwd command.

Even without sudo, each user can change their own - and only their own - password by using the passwd command with no parameters. When it is used in this way, any password quality checks configured in PAM cannot be bypassed by typing the new password a third time, like root (or someone running passwd as root via sudo) can do.

If you want to remove the password quality checks, in Linux they are usually controlled by PAM module pam_cracklib.so, pam_passwdqc.so or pam_pwquality.so, depending on Linux distribution used. There may be configuration files for these modules in /etc/security/ directory, or you can comment out the modules altogether from the configuration files in /etc/pam.d/ if you want to accept very simple passwords.

If the passwd command is working normally, you should only need sudo to allow user1 to change user2's password, like this:

user1 ALL= EXEC: PASSWD: /usr/bin/passwd user2

Allowing everyone to change everyone else's passwords is effectively the same as giving everyone unrestricted root access. That is usually a bad idea.

  • passwd = /usr/bin/passwd (it is link) = /usr/bin/passwd.shadow. So I have remove executable for other permision for passwd. Seems I should revert it (thanks for your comment). Also I find enforce_for_root option which help me with sudo passwd and short passwords. – TheFdu4 Dec 25 '17 at 14:31
  • Yes, /usr/bin/passwd is designed to have setuid root permissions, and will behave differently when run by a root user/sudo vs. someone non-root. When run by a non-root user, it will only allow that user to change his/her own password and won't allow bypassing the password quality checks. When run as root (either through sudo or as a real root user), it will allow more options. – telcoM Dec 25 '17 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.