Disabling commands

raptorman · 09-14-2005, 05:15 AM

Is it possible to disable certain commands like "rm -rf", "deluser"... from being runned in Debian, even when logged in as root?

theYinYeti · 09-14-2005, 06:26 AM

I'd say no, unless you're willing to modify the source code of those commands. This should not be too difficult, and after all this is what open source is all about.

Yves.

yanik · 09-14-2005, 09:04 AM

You could always link them to a script that says "Forbidden". But root is root, he could fix it easily. Unless root is a newbie?

rednuht · 09-14-2005, 03:58 PM

create a superuser + group let the admin use that and limit the superuser to access most stuff except the stuff you want protected.
as noted previously root is root !

theYinYeti · 09-15-2005, 04:12 AM

Don't forget that "rm -rf", "rm -fr", "rm -r -f", and "rm -f -r" do the same (and you can add other options), so filtering them will be a pain, though in most cases using getopts can help.

Yves.

raptorman · 09-20-2005, 06:57 AM

Thanks for the replies. I decided to create an "admin" with only access to the commands he'll need.