Default visiblepw in sudoers confirmation

mahesh manakawad · 06-07-2012, 12:33 AM

Hello everyone,

I have some questions because I need to work on Linux password management.

1. I want only admin can change other users password.
2. With sudo command I can change other user password.
3. What is the use of adding User ALL=(ALL:ALL) ALL in sudoers file.
4. What is use of Default visiblepw in sudoers file.

Please any one can help me to clarify above questions

Thank you

Slackyman · 06-07-2012, 01:43 AM

1 - With sudo passwd -n <MIN> <username> you can lock the <username> password for <MIN> days (<username> is the login-name of the user). To be sure users cannot change password you can use sudo passwd -n 10 -x 1 <username> since if tha minimum (-n) is greater than the maximum (-x) the user cannot change the password.
2 - you can do it with sudo passwd <username> (<username> is the login-name of the user)
3 - adding that line you allws User to use duso and run all commands.
4 - visiblepw is set OFF by default. Read this about visiblepw

mahesh manakawad · 06-07-2012, 02:03 AM

Hi Slackyman,

Thanks for your quick reply

I wanted to clarify how can I make only admin can change other user password.
Because I'm getting "no TTY present" error when I wanted to change other user password.
Please help me to solve this

Thank you again

Slackyman · 06-07-2012, 02:44 PM

Which distro are you running?
"Defaults visiblepw" in sudoers file enables sudo even if a console doesn't allocate a tty.
Change your file with visudo by adding Defaults visiblepw and you can use sudo.

mahesh manakawad · 06-07-2012, 10:34 PM

Hello Slackyman,
Let me define mine application clearly

1. I have created one j2ee application using SSHXcute jar.
2. I wanted to manage password of remote system using that application.
3. I'm login in to remote system and I can reset self password also but when I'm trying to change other user password I'm getting
"no tty present " Error.
4. Can you tell me how to resolve it.

Please let me know where I'm wrong.

Thank you

Slackyman · 06-08-2012, 12:29 AM

According to the sudo manual:

Quote:

By default, sudo will refuse to run if the user must enter a password but it is not possible to disable echo on the terminal. If the visiblepw flag is set, sudo will prompt for a password even when it would be visible on the screen. This makes it possible to run things like "rsh somehost sudo ls" since rsh(1) does not allocate a tty. This flag is off by default.

I suppose you have to make the change on local machine, not the remote.

mahesh manakawad · 06-08-2012, 12:36 AM

Hi Slackyman,

Can you explain me what changes I need to do in local machine?

Slackyman · 06-08-2012, 12:55 AM

Add a line in /etc/sudoers containing

Code:

Defaults visiblepw