-1

I have added the following lines in order to prevent normal users from soporte group to shutdown system:

cmnd_Alias     SHUTDOWN = /sbin/shutdown,/sbin/reboot,/sbin/halt,/sbin/poweroff
# User privilege specification
gponce   ALL=(ALL:ALL) ALL, !SHUTDOWN
# Prevent members of group soporte to execute shutdown command
%soporte  ALL=(ALL:ALL) ALL,  !SHUTDOWN

what am I doing wrong?

  • In CentOS7 and up, you'd also need to restrict systemctl halt and friends, and sudo bash -c poweroff etc etc. I hope this is not supposed to be more than a safeguard against accidents. – Ulrich Schwarz Jul 11 at 4:20
  • You did not tell us what happened when you tried it. – ctrl-alt-delor Jul 11 at 8:23
  • @ jeff. thanks for your suggestion. Well, even though I have configured in sudoers, all normal users can shutdown system anytime. – Gonzalo Ponce Jul 11 at 14:33
2

Using a blacklist for sudo is a futile effort. If you don't want users to be able to shut down the system, then you need to give them a whitelist of approved commands, rather than trying to block all of the possible commands and sequences of commands that will result in a shutdown, of which there's a lot more than you think.

  • I am changing the approach based in your recommendation. I am changing chmod for /sbin/shutdown and for poweroff, halt and reboot. thanks – Gonzalo Ponce Jul 11 at 14:39
  • @GonzaloPonce That doesn't work either, since they could just use sudo to chmod then back, or just create their own program that does the same thing (there's nothing magical about /sbin/shutdown). – Joseph Sible Jul 11 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.