1

I'm a newbie here.

I have deployed a Linux server and I wanted to add other users to it. Then those users must able to install applications on the said server. To do that those users must have root privileges (sudo group) to execute. So I have to add those users to the sudoers group.

The issue is I don't want them to reset root user password after they switching root user.

Is there any way to prevent this? Your support in this regard is highly appreciated.

5
  • Don't make them admins then, but rather add a line for each of those users with e.g. username ALL = NOPASSWD : /usr/bin/apt to the /etc/sudoers file using sudo visudo ... that would enable them to run only apt for example.
    – Raffa
    Commented Nov 29, 2023 at 9:06
  • 1
    @Raffa Won't help - they could build a deb package with a postinst script that modifies the root password and use apt to install it.
    – Shadur-don't-feed-the-AI
    Commented Nov 29, 2023 at 9:44
  • @Shadur Sure they could do that if they have bad intentions, but I guess you’re right as if trust would help then it would’ve helped in the first place :) … Probably a full per-user based virtualization solution would be more appropriate in this case, but would consume more system resources I think.
    – Raffa
    Commented Nov 29, 2023 at 10:11
  • 1
    If you cannot trust them, don't give them sudo rights ... as the saying goes, with great powers comes great responsibility. Create a procedure to request packages that you or your team install.
    – thecarpy
    Commented Nov 29, 2023 at 10:56
  • This seems like an XY Problem. You are trying to solve some undisclosed problem, and giving everybody permission to use apt seems like a great solution. But it's a terrible solution, don't do it. Instead, ask a question describing the original problem that led you to the everybody-apt dead-end. Perhaps we can help you find some better alternatives.
    – user535733
    Commented Nov 29, 2023 at 11:32

1 Answer 1

Reset to default
0

If you cannot trust people you should not give them administrative privileges. If they need access to software, create a procedure with which they can request software packages to be installed.

Someone who can install software 0wns the system, can do anything they want, including, and not limited to, taking your privileges away.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .