Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a server which other people will have sudo access to via ssh. They can install stuff and make changes as they see fit, however I still need to manage the server, install patches and software updates etc.

I'm wondering if I keep the root password so that I can always do what I need to, can I somehow disable people with sudo from being able to change it with sudo.

share|improve this question
1  
This sounds like a job for (removes civilian cloths revealing a superhero costume) OpenVZ or Usermode Linux or Jails or Zones!!! –  chris Aug 9 '09 at 15:48
    
the question is perfectly legal. –  AlberT Sep 28 '09 at 16:44

11 Answers 11

up vote 9 down vote accepted

You have to think about it like this. If you give them the root password, or a route to it, you're essentially asking "how can I give them root except for all the times when I magically don't want them to have it". And the answer is "you can't. Computers don't work that way."

share|improve this answer
    
Wouldn't it be great if they could. I, for one, await the window manager with a Focus-Follows-Mind mode. –  David Pashley Aug 9 '09 at 8:17
    
David: Maybe eventually :-) That would be excellent. –  Matt Simmons Aug 9 '09 at 15:37
    
Not really an answer to his question, now is it? –  Andrioid Aug 10 '09 at 9:18
1  
Actually, Andriod, I think it is. Maybe not the answer wanted, but an answer none the less. –  RobM Aug 12 '09 at 9:58
    
You can, any RBAC system allow you to accomplish a similar job. Saying computers don't work that way, computers are done to work the way creators are smart enough to make them do! –  AlberT Sep 28 '09 at 16:43

You can selectively allow certain commands with sudo, but you must be careful to not permit programs that allow shell access, writing to sym links, or one of a few dozen other problems. Here's a page on secure sudo scripting: http://www.kramse.dk/projects/unix/security-sudo-script_en.html

You could always hope that they don't know about the chattr command ;-)

share|improve this answer
    
+1 for chattr, or +i ;) –  hayalci Aug 9 '09 at 13:42

prevent them to change any password:

chattr +i /etc/shadow
share|improve this answer
1  
Then they run chattr -i /etc/shadow with sudo and are back in business. –  koenigdmj Aug 9 '09 at 0:23
1  
Not to mention the fact that it means that no other user can change their password either, which is really bad. –  womble Aug 9 '09 at 4:13
2  
I already wrote "prevent THEM to change ANY password". not many sparetime admins know chattr. In the past it was very usefull for me to know and use chattr. –  ThorstenS Aug 9 '09 at 9:10

I think the answer here depends on whether you are trying to stop them from maliciously changing the password to keep you out, or just carelessly getting the password because they forgot you need access. In the former case you are going to have a lot of trouble. I don't know under what circumstance you would give users root access to the box but still be worried about this, but the best you can do is try to limit their access to commands through sudo, which as others mentioned is tricky at best. In the latter case it seems like the solution would be to create yourself a user with sudo privileges. No one is going to accidentally change the password on your account so you don't have to worry about someone just making a mistake, or even changing the password for a good reason and forgetting to tell you about it because you can always get in with your account and change it back.

share|improve this answer
1  
In either of those cases -- malice or incompetence -- you really, really, really don't want to be giving them root access at all. +1 for the "keeping a separate sudo-capable account" around. –  womble Aug 9 '09 at 4:12
    
Having a separate sudoer account is is a great idea. –  Akilan Aug 9 '09 at 11:47

What you want isn't reasonable. Giving root to people in any form will allow them to wreck your system. Even if their access is via heavily regulated sudo, a clever or malicious or really deranged idiot will be able to cause mayhem.

You either trust them or you don't.

If you're supporting their needs and the firm as paying you to support them, it is their machine, not yours; you're only there to keep it working despite whatever foolish things they do. Maybe after they roast it a couple times you can ask your boss if you can give the clients less access or otherwise the firm will have to keep paying you to fix the mess. Whatever -- it's their dime.

If it is your computer and you're doing these others a favor, ask them politely to be nice.

That said -- you can always boot from CD (or other read-only media). They'll still be able to wipe out the other filesystems or mount over /etc with their own /etc, but all you need to do to get the system back to some rudimentary level of functionality.

You can also use something like openvz and give each user their own instance. They won't be able to wipe out the whole system and they'll be able to install their own software in their slice. Lots of places use this for web hosting where they give the clients "root" in the VZ slice.

share|improve this answer

There are a few options:

  • You could use PAM (Pluggable Authentication Modules) to allow you to log in as root, regardless of what they set the password to. There are a lot of modules available, so I'll just leave this one hanging.
  • You create 'a second root user' by opening /etc/passwd and adding a new user with the same UID as root (0). Then add a password into the /etc/shadow file for that specific user. This will allow you to log in as root and even if they change the password for 'root' - your login still works.
  • Create a shellscript that is run periodically to check if the hash of the root user in /etc/shadow for root matches the one you want it to be. If it's not, the hash is changed back.

As others have pointed out, giving root access will allow them to do absolutely what ever they like on the system and if they really want to lock you out; they can. The options above however make it harder or less transparent to them.

share|improve this answer

Solaris has solved this by making root as a "role" so nobody has a root password and root user cannot log in to system. To prevent anyone from locking you out, there are lots of fine grained security options; so you can have them do most of the root things with "pfexec" (equivalent of sudo) but you can be able to prevent them from revoking your sudo priviledges.

[[ I'm not a solaris fan, but there are some very good things in solaris other than ZFS and DTrace. Too bad If oracle extinguishes the flame ]]

share|improve this answer

SELinux can do what you're looking for, although it's like using a nuclear-powered planet-smashing battleax to swat a fly, or whatever the Hitchhiker's quote actually is. If you're set on Linux rather than Solaris (and its shiny RBAC), the easiest-to-implement option will likely to be to configure sudo to only allow the commands necessary.

share|improve this answer
1  
Actually getting the sudo permissions correct to absolutely contain someone is a steep hill. Once I've got a program running as UID 0, I've got just a thin paper wall between me and an actual root shell. Of course, that's assuming clever and hostile users, but still. –  chris Aug 9 '09 at 15:45
    
Just because you're paranoid, it doesn't mean they're not out to get you. –  Brad Ackerman Aug 11 '09 at 2:42

Instead of preventing them from changing the password, just make it a policy that they are not permitted to do so. Then you can set up something like auditd to watch the password file and notify you of changes.

share|improve this answer

If you can't use a system with RBAC, like Solaris, HP-UX or AIX, you can implement RBAC on Linux with the grsec patch.

share|improve this answer

I have question related to RBAC, I gave the access to operation team to change the password for other users using RBAC but in this case they can also change the root password, how I can prevent to change root password. I want to give permission to change other user's password not root.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.