Ubuntu

Linux ubuntu 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
Hi Folks,

Please help me. I am bit struck here.

Here is the OS info.
Linux ubuntu 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux

I have a user Alex( userif alex:admin) and trying to grant him sudo access to a userid (cbttest:sytgrp) i.e granting sudo to ID cbttest

I have added the following info to /etc/sudoers file.

alex ALL=(cbttest:sytgrp) ALL

It was working fine, alex was able to sudo to cbttest.

Now I want to restrict alex not to execute passwd change so tried the below options none worked.

alex ALL=(cbttest:sytgrp) ALL, !/usr/bin/passwd

Cmnd_Alias PASSWD=/usr/bin/passwd
alex ALL=(cbttest:sytgrp) ALL, !PASSWD

alex ALL=(cbttest:sytgrp) !/usr/bin/passwd

alex ALL=(cbttest:sytgrp) ALL, !/usr/bin/pass*

none of the above options worked. Please helpme in restricting the user to execute all like cbttest except passwd

The exact syntax should be:

Code:

alex ALL=(cbttest:sytgrp) ALL, ! /usr/bin/passwd

Let me know if this helps!

Hi Admin_Xor,

I tried that way too but it did not helped and more over... let me say this.. if the user copies the /usr/bin/passwd binary file to other location... he can execute that password..change...

All I am looking is in any means he should not execute the password... but he should be able to execute the rest all commands.

Looks like you have some kind of problem there. I tested this fully on my RHEL 6.2 box. It's working perfectly. Copying /usr/bin/passwd to another directory and executing does not even work in my case! What's going on in your Ubuntu box?

Here's the snippet in /etc/sudoers:

Code:

testuser ALL=(unixuser:unixuser)  ALL, ! /usr/bin/passwd

Here's what I tested:

Code:

[testuser@blue ~]$ sudo -u unixuser passwd
Sorry, user testuser is not allowed to execute '/usr/bin/passwd' as unixuser on blue.
[testuser@blue ~]$ cp `which passwd` .
[testuser@blue ~]$ ls -l
total 32
-rwxr-xr-x. 1 testuser testuser 32680 Feb 25 11:51 passwd
[testuser@blue ~]$ sudo -u unixuser ./passwd
[testuser@blue ~]$ sudo -u unixuser ./passwd unixuser

Can you check /var/log/secure? Also, make sure that you are using visudo to edit /etc/sudoers file as it will show you syntax error. Recheck all of the aliases you created and make sure there's no colliding rule which permits the user to execute passwd as another.

Admin: Here is the test case that I went through
My Sudoers File

Code:

# User privilege specification
root    ALL=(ALL:ALL) ALL

alex    ALL=(cbttest:sytgrp) ALL, !/bin/echo


[alex@ubuntu] "/home/alex/Desktop"
$ whoami
alex
[alex@ubuntu] "/home/alex/Desktop"
$ sudo -H -u cbttest -i
[sudo] password for alex: *******
[cbttest@ubuntu] "/home/cbttest"
$ whoami
cbttest
[cbttest@ubuntu] "/home/cbttest"
$ export DT=ABC
[cbttest@ubuntu] "/home/cbttest"
$ echo $DT
ABC
[cbttest@ubuntu] "/home/cbttest"
$ which echo
/bin/echo

If you are using Bash, echo is a builtin. The which command will not tell you that is is a builtin.

Ok.. then instead of echo I have set up /bin/rm ... still the sudo does not work as expected.
I set alex ALL=(cbttest:sytgrp) ALL, !/bin/rm
through visudo and there was no syntax error popped out.

was able to sudo to cbttest with alex.. tried to rm a file... I was able to delete the file(in general I should not....

Also I dont have any /var/log/secure*

Please advice