halt, reboot, poweroff, everybody!

Jerry Mcguire · 10-14-2010, 09:30 PM

Is there a way to limit 'halt' 'reboot' 'poweroff' commands only to the superuser 'root'?

Thanks.

AlucardZero · 10-14-2010, 09:35 PM

Don't grant sudo root access to other people?

Or use sudo as it was intended, instead of a blanket ALL=(ALL) ALL?

Jerry Mcguire · 10-14-2010, 09:41 PM

No no..

It is, anyone including non-sudoers who has logged in can type these commands in a tty or pts, and the system does it!

I'm on Red Hat 5 and Fedora 13.

Jerry Mcguire · 10-14-2010, 11:37 PM

man halt:

Code:

...
DIAGNOSTICS
       If  you’re  not  the  superuser,  you will get the message ‘must be superuser’.
Users logged in locally on the console can call halt,   reboot, and poweroff without
supplying the root password, due to pam_console (8).

I have no idea why pam_console is to be responsible or how to stop local users from 'reboot'ing... Anyone?

Jerry Mcguire · 10-18-2010, 01:06 AM

anyone? please.

zhaozhou · 10-18-2010, 09:15 AM

I wonder if this is a Red Hat issue. On my Gentoo installation, I've got no pam_console, halt is root only and the man page says:

Code:

DIAGNOSTICS
       If you're not the superuser, you will get the message `must be superuser'.

But I will try to help as best as I can.
In your /etc/pam.d you should have configurations concerning pam, and specifically, pam_console. Take a peep in there and paste any file you think has something to do with your issue here.