Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
1

On an Ubuntu linux server, I would like to prevent other root users / admins from changing the network settings. I want to set a static IP address/network settings and then lock it in a way that even other admins cannot change it.

Is there a way? How can I do this?

Thank you...

share|improve this question
are they root just like you or normal users ? if they are root i am afraid there is nothing you can do on the other hand if they are normal users there is a few possible things. – Prix Aug 23 '10 at 9:35
they are also root admin users – ICTdesk.net Aug 23 '10 at 11:03
5  
If you can't trust them not to fiddle with stuff like this then they shouldn't have root access, period. – RobM Aug 23 '10 at 11:08
there you have a good point Robert, however I am still interested to know if there is a technical solution :) or if it is just impossible – ICTdesk.net Aug 23 '10 at 11:13
There inst, if they are root they have the same level of access within the server as you do, if they have enough knowledge they can simply switch back any changes you may do to restrict them. but if they are normal users then they would be limited to do so. – Prix Aug 23 '10 at 13:09

3 Answers

up vote 2 down vote accepted

Elaborating on the answers above.

This fellow used SELinux to secure a machine with public root access as a proof of concept. SELinux - http://www.linuxjournal.com/article/6836 However, SELinux is an adventure to learn.

You could use the chattr +i above and just not tell them about it...depending on how clever your users are. chattr -i would allow any root user to edit the file. In addition +a allows only appending.

The "normal" way to do this would be to create normal users and specifically give them the privleges they should have via something like the free tool Sudo.

share|improve this answer
1  
additionally to +i , +a for some critical confs such as /etc* try to set +u (keep a backup of the file if it's deleted). But this solution works only if you use ext* filesystem. If you use something else, i don't think that is being supported. – Nikolaidis Fotis Aug 23 '10 at 14:15
1  
-2 is unnecessary. If anything the SE Linux root security link is original and 100% relevant to OP. Would also be nice if the downvoters would comment and let me know what it was voted down for, so I could address the issue in the future. – Joshua Enfield Aug 23 '10 at 15:29
Thank you, I will consider chattr +i, maybe in combination with lcap, but I will have to research this further. – ICTdesk.net Aug 25 '10 at 14:32
up vote 0 down vote

if these users are root, then no. However it should be possible to have layered administration using sudo and pam authentication levels using normal user accounts to perform the tasks needed day-to-day.

To avoid simple mistakes etc, you may find setting the configuration files immutable (chattr +i) may help.

share|improve this answer
up vote 1 down vote

Do they have access to the machine ? If no, then it's easy. If yes, then you could create a seperate group .. let's say superadmin and the only person in that group will be you.

How are they taking root priviledges ? Login ? sudo ? Without being totally sure, i think that SELINUX can help you assign priviledges based on the source ip.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.