I'm trying to edit
visudo, but I don't know how to change the root rights.
I want root to be prompted for the user1's password, when he tries to use
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Well, it's not really a good idea, but it IS possible. As somebody here pointed out, you can't prevent root from being the computer's god, but you can modify the "su" program to ask for passwords. It can prevent root from re-logging to other accounts unless he compiles his own version of su and uses it.
First, you'll need a compiler to be able to re-build su. As a root, perform:
apt-get install build-essential
Then, download and prepare the GNU Coreutils:
ftp://ftp.task.gda.pl/pub/gnu/coreutils/coreutils-8.13.tar.gz tar xvf coreutils-8.20.tar.xz cd coreutils-8.20 ./configure
Now access the src directory and locate the su.c file. In line 223, you'll find:
if (getuid () == 0 || !correct || correct == '\0')
Change it to:
if (!correct || correct == '\0')
Now, back in the coreutils-8.20 directory, run make. Compilation might take long time. Once it's done, overwrite the current su binary with the new one:
cp src/su `which su`
And again - you're doing it wrong.
Root can become any user without requiring any authentication. Even if the
su command was configured to prompt for a password, root could use some other program to issue the underlying system call. The
su command is normally configured not to require a password because it's useless for security, and a lot of non-interactive scripts rely on that to perform tasks as a less privileged user.
On Ubuntu (and many other systems that use PAM), the absence of a password prompt when root runs
su is implemented by the following line in
auth sufficient pam_rootok.so
su are completely different programs. You can't change the behavior of
su by changing the configuration of