1. I have two users admin and root. admin user is not in sudoers and only runs a menu of restricted commands.
2. root account access is restricted to shell based protocols like scp, ssh etc.
3. Default login to the system is admin.
Question : I need to disable root account access by default. (Easy part : I can do it by changing root shell to /sbin/nologin.) But then I need to allow access to root shell from a specific menu option being run by admin for troubleshooting or only when needed and only for those who have a root password. (Tricky Part : Once I disable the root shell, it disables it for all )
Is there a good way to enable root account access from a specific account without having to expose it to everyone ?