Setting user up to reset others passwords

[JohnMuir]

I am running on v10.20 on a system that is not set up as a trusted system and is not running pseudo. I need to set up one paticular user to reset other users passwords. Can anyone tell me how I need to configure this users account to accomplish this?

[Brian Bergstrand · Accepted solution]

man sam

Specifically you want to use:

# sam -r

From the man page:

-r Invoke the Restricted SAM Builder. This enables the system administrator to provide limited nonsuperuser access to SAM functionality. You must be a superuser to use this option. See "Restricted SAM" below for more information.


HTH.

[Zeev Schultz]

Install sudo http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/ , create special hp-ux user that can do
this (run passwd as root) and others (if needed) tasks.

[Jeff Schussele]

Hi James,

There are 2 ways to do this:

1) Install & configure sudo so that this user can run the passwd command. (Preferred)

2) Give the user a restricted SAM session (sam -r) so that they can reset PWs through SAM.

HTH,
Jeff

[Kevin O'Donovan]

As far as I know only a root user can reset other users passwords...

You could maybe do something like create a shell script that takes a username as an argument and resets that users password, make it executable (but NOT writeable) by owner and group, owned by root, and setuid set. Create a group that only that user you want to setup the password is in, and chgrp the file to that group.

Then, only that user and root should be able to execute the shell script, and you have a user which can reset passwords!

Maybe as extra security put it in a directory that only that user can access, but has no write access to (r-x the directory).

Setuid isn't generally recommended because there's a security issue with using it (must start a thread asking about that actually) but if you take the precautions above it should be fine I'd imagine!

hope that helps,
Kevin.

[JohnMuir]

Thanks for the help everyone. Setting up the restricted sam for the user is what I needed. Now I just have to instruct the user on how to use this feature.