Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need to set 2 passwords for a user, like:

One password for normal usage and another one for sudo access.

How is this possible?

share|improve this question
1  
Why not just make 2 accounts, one for normal usage and the other allowed to use sudo. –  Luis Alvarado Feb 19 '13 at 4:30
    
no i need it in only one account –  S.Varun Feb 19 '13 at 4:32
    
Why do you need this to be one account? You can create a separate account with sudo access but without a separate home folder then add this user to the same group as the normal user and set it to use the same home folder with sudo usermod -d /path/to/new/home –  Warren Hill Feb 19 '13 at 8:22
    
@SVarun I updated my answer with steps that work for me since you last commented. Could you check it and let me know if it works for you? –  Aaron D Feb 25 '13 at 10:52
add comment

1 Answer 1

up vote 7 down vote accepted
+50

There is a way to do this by overriding the PAM (Pluggable Authentication Module) settings for the sudo service. Do this at great risk to your machine - don't just copy and paste unless you understand what the command does, and always keep a root terminal open - test test test! - before logging it out, in case you need to go back and fix something.

I recommend reading some information about how PAM works so you know what to do if it breaks. I also recommend most users approach this problem from a different angle (making a separate user account for administration) because the solution may be susceptible to hash table attacks on your password if you haven't set your permissions correctly.

If you're determined to proceed, you'll need to install a new PAM module. pam_pwdfile uses the old-style /etc/passwd type file for authentication, which is great for using different passwords for different services. It provides no account recognition - you can create username/password pairs for users that do not exist on the system. Since we'll be using it for sudo, it doesn't matter, as we'll just let sudo check the account exists in the usual way.

sudo apt-get install libpam-pwdfile

I also recommend grabbing a handy htpasswd file editor. Benjamin Schweizer has created a handy editor in python which works well. Grab it from http://benjamin-schweizer.de/htpasswd_editor.html and install its dependency:

sudo apt-get install python-newt

Generate a htpasswd format file using the tool - sudo python htpasswd_editor sudo.passwd. Put in a username and password using the same username that you will be using for sudo - one for each user that will be using it. Copy it to somewhere secure (when testing this I put it in /etc/sudo.passwd) and make it unreadable to regular users: chmod 660 /etc/sudo.passwd as root.

** Make sure the file is owned by root and unreadable to other users.** This is a vulnerability as the file contains a hashed password, and if it is readable or writeable by other users, it breaks your security badly. It is for this reason I don't recommend this method on a machine that must be kept secure.

Finally, edit the /etc/pam.d/sudo file. Add the following line above the other @include ... lines:

auth    required    pam_pwdfile.so pwdfile /etc/sudo.passwd

Obviously replacing the last argument with the path to your generated htpasswd file. Comment out the next line: #@include common-auth to make sure it is using the new authentication method.

** Word of caution** - you will need to edit the /etc/pam.d/sudo file from a root terminal. Do not close this without testing! If you do, you may not be able to log back in (if you have broken something), and would have to boot from a Recovery disk to repair your system. Test before logging out by opening a new terminal and try using sudo. You should find that it will no longer work with your regular login password, but instead requires the new password you used when you generated the passwd file. To update the file, use the useful tool again.

share|improve this answer
    
i need to run in Ubuntu is there any other way –  S.Varun Feb 19 '13 at 8:03
    
I updated the answer - I have tested this method and it does what you want, if I have understood your question correctly. Please try it. –  Aaron D Feb 20 '13 at 3:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.