I am adding sudo rules for L0 team wherein they will be able to change password for OS users.
BUT i dont want the L0 team to change root password using sudo How to do it
PS - !/usr/bin/passwd root - is not working
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityThe only way I see a chance if your user authentication is done using classical /etc/shadow passwords:
Write your own passwd
-alike program that only allows changing of passwords of non-root users, and only allow that (e.g. via sudo yourprogram
). /etc/shadow is really not hard to parse or write.
Much more sensibly, if you have "teams", you probably have some form of centralized login mechanism (LDAP/Kerberos?), and then the LO team (whatever "L0" is) should not be using passwd
at all, but interfacing directly with that system, which probably offers much finer access control.
As is usual with questions about sudo
, the answer is "write a wrapper script, only allow that script to be run with sudo".
That is, write a script that checks its arguments to make sure that a username is supplied AND that the username isn't root (and/or other system accounts. Or perhaps check if the UID corresponding to that username is in the range allocated to normal users...typically 500+ or 1000+, depending on distro).
If it passes whatever validation checks you need, run passwd
with the appropriate arguments. If not, abort with an error message, and maybe log the failed attempt.
Then, configure sudo
to allow the users to run the script as root, but not passwd
itself.
Since the script is being run as root, all programs run in the script (including passwd) will also be run as root.
And, because the script is run as root, you need to be especially careful about what you run in the script and how you run it. Quote your variables, don't trust user-supplied data (i.e. don't pass arguments directly to other programs without validating them - it is generally best to reject anything that isn't specifically allowed rather than accept everything that isn't specifically forbidden. There will be less loopholes that way). Keep the script short and simple and easy to understand & debug, it should do the minimum necessary to validate its input and get the job done.