Forbit to change root's PW with sudo

[Thamm]

Hi,
we have started to introduce sudo on our servers.
We are using the strategy to give every group of sudo users "ALL" permissions and dissallow some commands.

Here is an extract of the sudoers-file to make this way clear:

User_Alias TEAM1=%team1
.
.
.
Cmnd_Alias SHUTDOWN=/usr/sbin/shutdown,/sbin/shutdown
.
.
.
TEAM1 ALL=ALL,!SHUTDOWN

Now I would allow/disallow some sudo-groups:
to change the passwort of all users but not the passwort of the root user by using the "passwd" command.

Do you have suggestions how to do this?

Thanks in advance,

Stefan.

[Chris Wilshaw]

You'd need to write a wrapper script to call the passwd command in order to validate the ID before trying to apply the change

eg:

#!/usr/bin/sh

ID=$1

if [ "$ID" = "root" ]
then
echo "You are not authorised to change the password for this ID".
exit 1
fi

passwd $ID

[Michael Tully]

I think the best method (sticking with sudo) is differntiate the groups of people. Have a look at the examples here and see what you think. You can restrict doing this directly from the sudoers file.

http://www.courtesan.com/sudo/man/sudoers.html#examples