I am trying to give user a privilege to change other users' passwords, BUT excluding root's password.

I have edited the /etc/sudoers file with visudo and appended the following line:

myuser ALL=/usr/bin/passwd

It works now, the user "myuser" can change passwords by command sudo passwd otheruser, BUT they can also change root's password!

How can I exclude the option of changing root's password?


The sudoers man page (v1.9.1 linked) actually has an example for this:

pete      HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd *root*

The user pete is allowed to change anyone's password except for root on the HPPA machines. Because command line arguments are matched as a single, concatenated string, the ‘*’ wildcard will match multiple words. This example assumes that passwd(1) does not take multiple user names on the command line. Note that on GNU systems, options to passwd(1) may be specified after the user argument. As a result, this rule will also allow: passwd username --expire which may not be desirable.

You could adjust that example for your situation:

myuser    ALL=/usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd *root*

... noting the caveats from the manual.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.