LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-20-2006, 06:04 PM   #1
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547
Blog Entries: 7

Rep: Reputation: 55
Sudo Help...


I have enable sudo in a linux server where we have about 300+ user accounts...
in visudo I have specify who can use sudo "IT Department" and I didnt ad the users... But when the users who where able to change there pass before I enable sudo they are no longer able to change there pass?!? I want each user to be able to change there own pass without having to use sudo...
Is this normal? adding passwd to the Cmnd_Alias will restrict others from using it if there not in sudo.conf?

I have RH Enterprise 3

Thank You!
 
Old 06-20-2006, 11:59 PM   #2
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Just curious: Why in the world would you make regular users sudoers for the passwd program? Everyone should already be able to change their own password.
 
Old 06-21-2006, 01:11 AM   #3
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
I didnt.
I enable passwd in the sudoers file so the IT department can change password for those users who for get there password.
I know users can change there password but when I put passwd in the sudoers file it wont let the users change there passwords...
If you want I can post my sudoers file here so you can see my config maybe you can spot the prob...

Last edited by SeRi@lDiE; 06-21-2006 at 01:13 AM.
 
Old 06-21-2006, 09:51 AM   #4
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
Bump^^
Any body?
This is becoming a big problem...
 
Old 06-21-2006, 09:56 AM   #5
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
I just found out that is not just adding passwd to the suoders file...
I remove passwd from the sudoers file and I still have the same problem... If I disable sudo passwd will work for every user.
Any ideas?
 
Old 06-21-2006, 10:11 AM   #6
binary_y2k2
Member
 
Registered: Jul 2005
Location: England, UK
Distribution: Ubuntu 8.04 Server, Kubuntu 12.04
Posts: 698
Blog Entries: 1

Rep: Reputation: 31
You should just need to add
Code:
%IT	all = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
This should let members of the IT group change all passwords except root.
 
Old 06-21-2006, 03:04 PM   #7
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
binary thanks for the reply but the problem I have is if I enable sudo regular users can not change there own password.

I wan the regular users to change there own password when it expires... If I enable sudo it wont let the users
change there own password....
 
Old 06-21-2006, 03:20 PM   #8
binary_y2k2
Member
 
Registered: Jul 2005
Location: England, UK
Distribution: Ubuntu 8.04 Server, Kubuntu 12.04
Posts: 698
Blog Entries: 1

Rep: Reputation: 31
That's strange, my system uses suso and any user can still change there pass
 
Old 06-22-2006, 12:11 AM   #9
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
Very strange indeed!
This a big problem for me....
Maybe that my sudo is out off date...
Going to upgrade the server....
 
Old 06-23-2006, 03:51 PM   #10
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
Any Body? ^^
 
Old 06-23-2006, 04:33 PM   #11
katayamma
Member
 
Registered: Jan 2006
Posts: 37

Rep: Reputation: 15
The regular users should only be doing a standard passwd command. The IT department will use the 'sudo passwd username' command.

Is that how you've got it setup?
 
Old 06-23-2006, 11:38 PM   #12
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
Yes thats how I have it setup...
But once enable sudo the IT department is able to change password for other but users are unable to change there own password.
 
Old 06-24-2006, 02:08 AM   #13
katayamma
Member
 
Registered: Jan 2006
Posts: 37

Rep: Reputation: 15
Are they trying to change their own individual password with sudo? ie. is bobj trying to change the password for bobj with sudo? That's a no-no. They should change their own password with the regular password command.
 
Old 06-24-2006, 02:33 AM   #14
SeRi@lDiE
Member
 
Registered: Jun 2006
Location: /dev/null
Distribution: Slackware 13.1, Slackware 13.37, aptosid, rhel
Posts: 547

Original Poster
Blog Entries: 7

Rep: Reputation: 55
Quote:
Originally Posted by katayamma
Are they trying to change their own individual password with sudo? ie. is bobj trying to change the password for bobj with sudo? That's a no-no. They should change their own password with the regular password command.

Yes I know the users have no idea about sudo they dont even know what sudo is...
sudo is only for the IT department.... users are trying to change there password by running passwd and it dont work for them.
 
Old 06-24-2006, 01:54 PM   #15
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
I understand what you're describing now, but I've never seen this problem in RHEL3. Are you sure the only change you made was to the sudoers file? You weren't messing around with PAM or anything? How about selinux?

If you're sure, then this would be a good time to make use of that support contract. Sounds like a bug, perhaps. (Assuming you haven't been playing around with other things.)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Restricting Editing in Sudo (Advanced Sudo Question) LinuxGeek Linux - Software 4 11-04-2006 04:20 PM
sudo kaplan71 SUSE / openSUSE 4 09-26-2005 11:42 AM
About sudo alnreddy Linux - Security 3 06-13-2005 01:53 PM
need help with sudo mla Linux - Software 4 10-02-2003 12:05 PM
sudo? nabil Linux - Security 1 02-12-2001 02:18 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:10 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration