Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

This question already has an answer here:

I want to prevent a user from changing their own password. Additionally, if possible, I want to prevent them from changing it via sudo.

share|improve this question

marked as duplicate by bodhi.zazen, Radu Rădeanu, Seth, bcbc, Basharat Sialvi Jun 11 '13 at 3:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
A good question, I look forward to seeing the answers... I haven't go a clue :) –  SimplySimon Jun 10 '13 at 14:07
3  
If they can use sudo, then you can't prevent them from doing anything. –  psusi Jun 10 '13 at 14:15
    
@psusi you have a very poor grasp of how sudo works –  Sparr Jun 10 '13 at 15:57
    
Probably @psusi was talking about default sudo config, i.e. the user is member of sudo group. –  Eric Carvalho Jun 10 '13 at 16:24
    
The only way I know of to restrict root (sudo) would be to use apparmor. See ubuntuforums.org/showpost.php?p=9799756&postcount=5 (you will have to modify that for your needs). –  bodhi.zazen Jun 10 '13 at 18:06

4 Answers 4

Change the password minimum age:

sudo chage -m 99999 <username>

If the user is clever enough and he has sudo priviledges, you'll have a hard time trying to stop him. If you remove passwd permissions he could fix it running sudo chmod u+xs /usr/bin/passwd. If you rename passwd file he could fix it running sudo apt-get install --reinstall passwd.

I think all you could do is to give a group (or a user) the rights to run specifics commands. If you allow them to run arbitrary commands and you try to deny them running specific commands like passwd, bash or anything "harmful", that could be easily bypassed by cp /bin/bash ~/myshell; sudo ./myshell.

share|improve this answer

chmod u-s /usr/bin/passwd

might work

share|improve this answer

To avoid a user from running the passwd command, just make it non-executable for everyone but root.

sudo chmod o-x /usr/bin/passwd

Don't forget, there are more ways to change a password other than with Terminal!

Also visit https://help.ubuntu.com/community/BasicChroot to see if this helps

share|improve this answer

You could install

ninja

but be carefully with configurating it.

When you configurate it wrong, then you are one level deeper and may not work as admin any more resp. you might then be not allowed any more to use terminal/shell/konsole as before !

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.