Cfxtrjtrk

I would like to limit one of my sudo users to only be able to reset a users password. I do not want them to have any other administrative privileges but that.

I know how to block certain access, but how would I block everything but passwd.

First of all, if you are even considering restricting admin privileges of any user you should first do sudo gpasswd -d [username] sudo as soon as possible because they have full access to the system until removed from sudo.

Now, there is a way to allow this type of task, but it still is very dangerous and problematic and can lead to disasterous situations.

1. Obviously you cannot allow this user to have unrestricted access to passwd because then there will be nothing stopping him from passwd root .




2. However, you still want to give him access to reset passwords of users not belonging to administrative group. This is a strategy I can think of:

You have a power user named fakeboss that will be resetting passwords for users. You make him a special folder, lets call it /usr/local/fakeboss/ that only his group and sudo can access.

A root creates a basic user named user1, and a script that will have read and execute permission only called user1pw.sh with:

chmod 755 user1pw.sh and puts it in /usr/local/fakeboss/

inside the script root writes, ($1 is the new password argument passed, and I checked it quickly but most piping of other commands either resulted in permission denied or changed user1 password to the piped string, but still I would need to double check this part)

#!/bin/bash

filtered=echo $1 | tr -d '[:cntrl:]'

echo "user1:$filtered" | chpasswd

echo "You just reset password for user1"

then in /etc/sudoers root adds


fakeboss ALL = NOPASSWD: /usr/local/fakeboss/user1pw.sh

as well as /usr/local/fakeboss/ to the secure_path line in /etc/sudoers

you top it off with an alias for fakeboss

alias user1pw ='sudo /usr/local/fakeboss/user1pw.sh'

and they now can change user1 password to a new one they send as argument with lets say:

user1pw IamYourBoss!

which will set user1 password to IamYourBoss!

and this tactic can be implemented for all users chosen by root, and these users will be able to have their passwords unlocked by fakeboss. More importantly, fakeboss has no access to the password reset scripts as they are unwriteable and has no passwd permissions nor any sudo permissions beyond these password reset scripts. One last thing I would add is certainly some serious logging mechanism as well perhaps system message sent to root stating that user1 had their password reset at this and this time for security and integrity.

I wrote this quickly and might have missed a detail or two but this is certainly way safer than allowing a user pseudo-sudo user unrestricted access to passwd.

Edit: Added input filtering,