I have tried this: ALL=/usr/bin
, !/usr/bin/passwd
, !/usr/bin/su
, but not success.
Is it possible user with sudoers permission can't able to change any password except his own user account ?
pete ALL = ALL, !/usr/bin/passwd [A-Z][a-z]*, /usr/bin/passwd pete
This should work. Source is the sudoers manual.
pete
can run any command, except passwd <something>
, except passwd pete
. Also, you might want to remove pete
's ability to create and delete users, else he can just delete user, create it again with some other password. I'm not sure if it's a possibility, but I sniff a chance. :D
Nov 10, 2014 at 6:45