Disallowing sudo user to not able to add user

trackstar2000 · 12-09-2019, 09:57 PM

To allow a sudo user to be able to run commands but not able to add user to the system. Is it possible to do this in Ubuntu? I am assuming its in the sudoer file.

Thanks,
TT

berndbausch · 12-09-2019, 10:24 PM

The sudoers file allows you to specify a "white list" of commands a specific user or group can execute with sudo. It also allows "blacklisting" by putting an exclamation mark right in front of the command.

There is at least one example in the sudoers man page:

Code:

pete		HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

You could put useradd in this list. However, a user with root privileges can still add the user manually in the passwd and shadow files. I don't know how you can prevent that from happening.

Turbocapitalist · 12-10-2019, 12:04 AM

Quote:

Originally Posted by berndbausch

I don't know how you can prevent that from happening.

It's there in the first line of your answer.

Quote:

Originally Posted by berndbausch

"The sudoers file allows you to specify a "white list" of commands a specific user or group can execute with sudo. "

Using a whitelist is the only way to achieve the goal: make a list of the specific commands that the account should be allowed to run as root and ennumerate them in /etc/sudoers.

Yeah, technically the syntax allows blacklisting but there are an infinite number of ways to circumvent anything you might try in that regard. There have been several articles and talks about that but it's an easy enough thought experiment to walk through.

berndbausch · 12-10-2019, 12:20 AM

Quote:

Originally Posted by Turbocapitalist

It's there in the first line of your answer.

My fear is that whitelisting won't help the original poster, since they mention open-ended "commands" that the user should be able to run. Let's see if anything comes around.

After thinking a bit more, I also believe that blacklisting is not effective. One would have to design the blacklist with a lot of thought and effort to exclude workarounds.

In short, sudo is probably good for giving blanket root privileges, or for allowing a very narrow, carefully crafted command set to have root privileges.

jefro · 12-10-2019, 03:35 PM

There are other ways around this. The problem is more of why you made a user sudoer to begin with. This entry almost assures one is root except as noted way above. One way around is to have a user without sudoers and give them all they need normally or give them an ability to su to a higher user that has all they need actually. Setuid special permissions on the tasks that you want only root to have privilege on.

frankbell · 12-10-2019, 08:43 PM

This tutorial may help: https://www.howtoforge.com/tutorial/...ginners-guide/

My understanding is that, in a default Ubuntu installation, only the installing user is given sudo rights. Other users added after time of install do not have sudo access unless it is manually granted by installing user.

ondoho · 12-11-2019, 02:06 AM

I'm just gonna leave this here:
Sudo: You're Doing it Wrong
Long story short: sudo is much, much more configurable & powerful than the average Ubuntu use case.
Not that I know from experience, but I'll take the developer's word for it.