1

I have a spare computer running as a small server doing various things, and I'd like to create another account for my cousin, so she can learn how do manage a server/run minecraft etc. I'd like to give her sudo privileges, but I was wondering if it's possible to disallow the use of the passwd utility, so she can't change my password (accidentally or intentionally)?

19wolf
  • 115
  • 1
    This is practically impossible.if you grant her the permission of the root, then there's nothing you can do to prevent her from doing anything – Nidal Jun 16 '14 at 22:42
  • 1
    yes and no. You can configure sudo to disallow any command. But by allowing ALL others there will be a way around (e.g. vi /etc/shadow, or edit the sudo config file, or just break everthing ). However it can stop accidental usage, but what other command must you stop accidents on. – ctrl-alt-delor Jun 16 '14 at 22:42
  • 1
    There's really no truly functional way, without going down the rabbit hole of all possible commands, since you have to exclude commands you don't want a user to run, rather than having to specifically include commands they are allowed to use. Meaning you have to prevent things like 'sudo bash' followed by 'passwd root', and if you disallow '/bin/bash', you have to catch 'sudo cp /bin/bash /tmp/bash ; sudo /tmp/bash'. – Tim Kennedy Jun 16 '14 at 22:43

2 Answers2

4

Create a virtual machine, and have her log in to and use that. She can have complete root access within the VM, without affecting the host at all.

Greg Hewgill
  • 7,053
  • 2
  • 32
  • 34
1

If you give your cousin sudo privileges for execute any commands she has superuser privileges and can do anything with system. Right solutions - give sudo only for minimum required commands (for example vi /etc/init.d/minecraft оr /usr/bin/netstat). But remember, that many harmless commands (example less or find) allow to execute over commands.

If you don't want configure /etc/sudoers and just want protected from fool you can use some 'workaround':

  1. delete or move /usr/bin/passwd
  2. restore /etc/shadow from backup every 5 minutes by cron
  3. add in root .bachrc alias passwd='echo Nonono'
mr_tron
  • 364