How can I give a user one password for normal usage when logging in, and another password for system administration and sudo access? I want one user to have two passwords.
There is a way to do this by overriding the PAM (Pluggable Authentication Module) settings for the sudo service. Do this at great risk to your machine - don't just copy and paste unless you understand what the command does, and always keep a root terminal open - test test test! - before logging it out, in case you need to go back and fix something.
I recommend reading some information about how PAM works so you know what to do if it breaks. I also recommend most users approach this problem from a different angle (making a separate user account for administration) because the solution may be susceptible to hash table attacks on your password if you haven't set your permissions correctly.
If you're determined to proceed, you'll need to install a new PAM module. pam_pwdfile uses the old-style /etc/passwd type file for authentication, which is great for using different passwords for different services. It provides no account recognition - you can create username/password pairs for users that do not exist on the system. Since we'll be using it for sudo, it doesn't matter, as we'll just let sudo check the account exists in the usual way.
I also recommend grabbing a handy htpasswd file editor. Benjamin Schweizer has created a handy editor in python which works well. Grab it from http://benjamin-schweizer.de/htpasswd_editor.html and install its dependency:
Generate a htpasswd format file using the tool -
** Make sure the file is owned by root and unreadable to other users.** This is a vulnerability as the file contains a hashed password, and if it is readable or writeable by other users, it breaks your security badly. It is for this reason I don't recommend this method on a machine that must be kept secure.
Finally, edit the
Obviously replacing the last argument with the path to your generated htpasswd file. Comment out the next line:
** Word of caution** - you will need to edit the