I seems that a user set as an "Administrator" can change passwords of not only "Standard" users, but also other administrators. Is there a way to make it so that administrators (there are multiple on this system) cannot interfere with the accounts of other administrators (i.e. they could only manage users "below" them)?

  • 2
    They could simply become root and do whatever they wanted. – muru May 9 '15 at 18:07

The important property of administrators on Ubuntu is that they can perform whatever actions they choose, as root, using sudo and polkit. This is necessary, in order for them to have the power to fully administer the system. And this is already how an administrator changes the password of another user.

Considerable restrictions would have to be put in place in order to stop this effectively, which would result in the administrator not effectively being an administrator anymore. Even if you painstakingly configured the system with numerous exceptions (perhaps via AppArmor or SELinux) to keep them from doing this, they could pretty easily regain this power if they can:

  • Run some command as root that itself lets them inject and run an arbitrary command.
  • Edit arbitrary files on the system.
  • Edit or create a configuration file that controls who can run commands as root and what commands they can run (such as /etc/sudoers, or files in /etc/sudoers.d), even if they are not permitted to edit all root-owned files.
  • Edit a configuration file involved in automatically running commands as root, such as /etc/crontab. Or, similarly, schedule at jobs for root.
  • Install arbitrary software. They could make a package that does any of the above things automatically as root during the configuration step of its installation. Or they could make a package that lets them do it when they run the software it installs (for example, it could install setuid executables owned by root written to break the restrictions imposed).
  • And those are just examples. This is nowhere near an exhaustive list.

I suspect that what you really want may be one of the following:

  1. To create a limited user with some additional powers, but not the full power of an administrator, and not the power to run arbitrary commands as root or edit most systemwide configuration files.

    This would start with the simple step laid out in ByteBOT's answer--the user needs not to be an administrator, for the limitations to effectively be imposed.

    Whether or not this is practical depends on the specific powers and limitations you want to them to have. (It is not practical if you want them to be able to do everything except reset administrators' passwords, see above.) If the powers you want to give them are well defined and not too expansive, it may well be feasible.

  2. To stop fellow administrators, or perhaps personnel who are officially supposed to do as you say, from behaving in a way you consider wrong or harmful. If this is the situation, that's not really a technical problem. Attempts to solve this sort of problem through technical means usually have many more disadvantages than advantages.

    One of the reasons for this is that it creates a technical contest to resolve (read: perpetually fail to meaningfully resolve) a disagreement that should instead be solved by some combination of discussion, negotiation, explanation of the situation, or redefinition/dissolution of the relationship between personnel. Probably (hopefully) you do not really want to officialize petty squabbling and territorial infighting between members of your team.

  3. To create an automated mechanism that reminds administrators of this system that they are not generally supposed to change the passwords of other administrators.

    If that's what you want, and you understand it will not really keep an administrator who wishes to reset any password from doing so, then I believe it is doable.

If you are trying to solve problem 1 or problem 3, you might consider posting a new question about it, with details.

| improve this answer | |

For the reason muru stated in his comment above, it is impossible to restrict some actions for administrator accounts. Even if you can achieve that the admin may not do this from within his/her own account, he/she still has the right to become root (sudo) and have no restrictions at all.

Sorry, but the only thing to restrict an admin's rights is to convert his admin to a normal account...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.