using sudo with passwd

[Todd McDaniel_1]

I have a strange problem after restricting passwd to root only.

I locked the passwd command so only root can use it and I granted sudo to a few application users who have a nologin login shell... so that they can change the applicaiton password with out me doing it. by loging in as themselves then su over to the oracle user with password.

However, when they use sudo, IF they only type "sudo passwd", It allows them to change the ROOT PASSWD... and instead of the oracle

They must use "sudo passwd oracle", in order to change the oracle passwd and not the root passwd.

Here is my question.... Is there a way to give them the passwd command and or prevent sudo from allowing them to change the root passwd?

[Brian Bergstrand · Accepted solution]

Yes. Simply add 'oracle' onto the passwd command.

So for the user group the command would be

passwd oracle

This will then restrict them to running passwd only with oracle as an argument.

Check out the sudoers man page for more info on restricting by command args.

HTH.

[Todd McDaniel_1]

Are you saying that in the /etc/sudoers file that I make it say?




oracle ALL=(ALL) NOPASSWD:/usr/bin/passwd oracle






So that they must enter this complete line in order for sudo to work for them?

[Umapathy S]

I have few doubts.
If those few users have a nologin login shell, how they are entering into the system. If there is no valid shell how can they run the su command itself.

sudo allows users to run certain commands as root. So obviously passwd is being run as root and the root passwd is changed. So, you have to change the sudoers file as you have mentioned only.

HTH,
Umapathy

[Brian Bergstrand]

Yes. 'man sudoers' describes the exact details as I'm just going from memory. But I think that is all you need. If they enter just 'passwd' or 'passwd root' or 'passwd joe' sudo will deny them access.

HTH.

[Todd McDaniel_1]

I may have misspoke...

The users login as themselves with SecurID login then with password over to Oracle...nologin is so that oracle can't be logged in directly.

Thanks for the help.