Your question is a bit confusing. I think you want to prevent users from running commands as root. If that's what you want:
- Don't give them the root password. If they already have the root password, change it.
- Don't allow them to use
sudo to run commands as root. Remove them from the
Forbidding users from running a few commands such as
bash while allowing users is completely useless. They'll be able to run any of hundreds of commands that allow running other commands (
gcc…). You can't achieve any extra security by blacklisting a few commands. If you don't want users to be allowed to run commands as root, don't allow them to run commands as root: keep them out of the
sudoers file, or only allow a carefully chosen set of commands which do not provide a way to run a shell or to overwrite arbitrary files.
It's possible to set up a wheel group such that only users in that group can become root by running
su, even if they know the root password. However, this is not really useful since user who know the root password can log in with
login. Again, if there are users who know the root password but shouldn't, that's what you need to address.