I have a rather unique situation that I need to come up with a solution for. We have servers by which a remote team requires having root access to our servers to perform certain jobs. We need to still allow them root access, but deny them from the ability to use iptables, visudo & passwd.
We are going to force them to not be able to login as root any longer and to login with user accounts that have all root functionality except for the above mentioned functions.
Can someone describe to me what I would need to do to accommodate this?