There are a few ways to achieve this . One would be working with a regular non-privileged account which will require running the command with sudo and entering a password. Then you can append the follwing to /etc/sudoers (by running visudo):
## user is allowed to execute reboot -r only
jdoe ALL=NOPASSWD: /sbin/shutdown -r *
Also, to disable sudo credentials caching , add the following as well :
Defaults timestamp_timeout=0
This will prevent credentials caching incase you invoked a command with sudo before.
Example:
[root@ops ~]# su - jdoe
[jdoe@ops ~]$ sudo shutdown -c
[sudo] password for jdoe:
[jdoe@ops ~]$ sudo shutdown -r +10
Shutdown scheduled for Mon 2018-09-03 18:51:13 IDT, use 'shutdown -c' to cancel.
[jdoe@ops ~]$ sudo shutdown -H
[sudo] password for jdoe:
^[[A[jdoe@ops ~]$ sudo shutdown -c
[sudo] password for jdoe:
Notice how in the above example I was not required to enter my password when running sudo shutdown -r +10
, but for the rest I was . If you want to remove the need for typing sudo before the command (sudo shutdown -r +10
), add the following to your .bash_profile or .bashrc:
alias shutdown="sudo shutdown"
Example:
[jdoe@ops ~]$ source ~/.bash_profile
[jdoe@ops ~]$ shutdown -r +10
Shutdown scheduled for Mon 2018-09-03 19:03:14 IDT, use 'shutdown -c' to cancel.
[jdoe@ops ~]$ shutdown -c
[sudo] password for jdoe:
Note that it's best practice to work with a non-privileged account and escalate with sudo when required.