Fedora Users — Re: [sudo-users] How to disable ( deny ) user to change the password of root

Re: [sudo-users] How to disable ( deny ) user to change the password of root

Date Prev

Date Next

Thread Prev

Thread Next

Date Index

Thread Index

To: Stephen Carville <scarville@xxxxxxxxxx>

Subject: Re: [sudo-users] How to disable ( deny ) user to change the password of root

From: edwardspl@xxxxxxxxxx

Date: Tue, 18 Nov 2008 12:30:15 +0800

Cc: sudo-users@xxxxxxx, "fedora-list@xxxxxxxxxx" <fedora-list@xxxxxxxxxx>

In-reply-to: <200811171059.11486.scarville@xxxxxxxxxx>

References: <49213001.5030003@xxxxxxxxxx> <200811171059.11486.scarville@xxxxxxxxxx>

Reply-to: "Community assistance, encouragement, and advice for using Fedora." <fedora-list@xxxxxxxxxx>

User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax)

Stephen Carville wrote:

On Monday 17 November 2008 00:49, edwardspl@xxxxxxxxxx wrote:

Dear All,

For the sudo setting ( visudo ) :

User_Alias      SYSADM = manager

Cmnd_Alias    NOROOT = !/usr/bin/passwd root
Cmnd_Alias    USER = /usr/sbin/adduser, /usr/bin/passwd, /bin/chown,
/usr/sbin/userdel

SYSADM    MH = (ALL)    NOROOT,USER

BUT the test result as the following :

[manager@xxx ~]$ sudo passwd root
Changing password for user root.
New UNIX password:

So, what wrong of the config ?

I think the exception has to be after the allowed rule:

SYSADM    MH = (ALL)    USER,NOROOT

It's been while since I checked that part of the code...

Hello to you,

Just test as the following rule is successfuly:

SYSADM    MH = (ALL)    USER,NOROOT

BUT there is another problem of it ( I think it is a bug of sudo ).....

When you enter "sudo passwd" without the option (eg:userid):

[manager@xxx ~]$ sudo passwd
Changing password for user root.
New UNIX password:

OH...the user manager who can change root password ?

So, is there any solution for this case of problem ?

Thanks !

Edward.

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines