I have one administrator account in my system which named as "admin". One more admin account called "test". I don't want test account to reset "admin" account and root account password in my system.

I have blocked sudo users by following command.

%sudo ALL=(ALL) ALL, !/usr/bin/passwd root,!/usr/bin/passwd admin

It's working on when executing this command as test user. If test user tries

sudo passwd root or sudo passwd admin

It throws following error called

Sorry, user test is not allowed to execute '/usr/bin/passwd root' as root on magesh-test.

But it's not working while executing the following command sudo passwd $root

How to block the test user alone in resetting the password?

  • 1
    What is $root set to? – muru Jul 22 '14 at 5:24
  • By executing "sudo passwd $root" is changing the root password. I don't get any idea how it works? – Magesh Arumugam Jul 22 '14 at 5:34
  • What is the output of echo $root? – Radu Rădeanu Jul 22 '14 at 5:35
  • 2
    @MageshArumugam it works like this: sudo passwd by itself changes the root password. If you haven't set the variable root to something, $root is empty and the command you showed translates to simply sudo passwd, which you haven't restricted. – muru Jul 22 '14 at 5:37
  • 1
    Also, this won't work in any number of ways. The test user can do sudo -i, sudo -s, sudo su -, sudo bash, ... (you get the idea) to get a root shell, where no restriction to passwd will apply. – muru Jul 22 '14 at 5:57