6

I have two users on a device UserX and user admin using Ubuntu 20.04, both have admin rights, but I want UserX not to be able to change the password of user admin. However, I still need to be able to allow UserX to install packages\applications and be able to use sudo, etc

Is there a method of restricting UserX rights not to be able to change the useradmin password?

1

1 Answer 1

5

Since "admin rights" is just access to UID 0, there is no way to restrict UserX.

There is a way to achieve this

  • remove "admin rights" from UserX.
  • use sudo to grant UserX access to specific commands as root (UID 0).

Read man sudo sudoers to get started.

2
  • Further reading hint: Using sudo would end up with "grant user all except some commands via sudo" (blacklist approach) or "grant user only these specific commands via sudo" (whitelist approach). There are caveats with using the blacklist approach, those are discussed in this question on U&L SE.
    – orithena
    Feb 2, 2023 at 13:28
  • The safer way to do ANY security thing is "Deny all, allow narrowly defined exceptions". The other way "Allow all, deny specific hazards as soon as you find out" will have you playing an unending game of Whack-A-Mole, falling ever further behind. BTDT, didn't like it.
    – waltinator
    Feb 21, 2023 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .