0

(fresh linux user)

Can I restrict all users (sudo as well) to enter password to edit the file?

I have /etc/dnsmasq.conf file where is websites whitelist specified. I want to set password to allow to modify this file.

Is it possible?


edit: The problem is: I am a man whose need restrictions. I want limit myself to edit this flle. I want add difficult password to this file, print this password and hide in the basement. (i am serious). Therefore it must be something sudo can't modify.

1

Short answer: No.

Long answer: It depends.

Are you willing to lose full root access? If not: it cannot be done. The root user is, by definition, the user that can do everything including totally and utterly destroy the system, but also read and write all files. I answered a similar question here. It is logically impossible to both be root and not have access all files.

However, if you are willing to give up root access, you can. You just need someone else to have root on your machine (Let's say your spouse - I mean, this is about porn, isn't it? I know it is... It always is.), and you get an account without root rights: A so called "Standard User". At that point, you will not be able to edit that file because you're not in the sudoers group. Your spouse will. However, it comes with the limits of not being able to install software and do other system maintenance tasks.

This isn't a full protection. Unless the disk is encrypted (and you don't have the password), you can still boot withe a LiveCD/USB and go modify the file. Technically, protecting you from yourself is close to an imposibility.

| improve this answer | |
  • thanks for reply. 1) I need root access all the time, 2) this is not about porn, much worse, it's about world news, political, sports etc. I need internet and root access as a web developer but I am addicted to click on distracting websites during work time. – Sruj Sep 6 '16 at 14:13
  • Okay, it's not porn. Good for you. There is no solution: you can't both be the total ruler of a machine, but lock yourself out from one part. That's logically impossible. Given you are web developer and logic is a mandatory prerequisite for doing such a job, you must see that. – jawtheshark Sep 6 '16 at 14:17
  • yes, it is logical. I just looking for a trick. – Sruj Sep 6 '16 at 14:19
  • What you can do is externalize the problem: Set up your router in such a way that it only allows access to the whitelisted sites. Then let a friend/spouse/someone set the password on the router. You have root on your machine, but the router (an external device) blocks you from accessing sites you shouldn't visir. Don't misunderstand me, there are still ways around it, but well... it may be a start? – jawtheshark Sep 6 '16 at 14:22
  • 1
    No, that doesn't change anything. The normal root user, and you have it, would still be able to change the file. A root user can, by definition, take ownership of any file. If you can take ownership, you can change it. It's that simple. Playing with the permissions of system files is also relatively dangerous if you don't know what you are doing. You might end up with a non-functioning dnsmasq because it can't read the configuration file any more. – jawtheshark Sep 6 '16 at 14:46
0

Im not aware of any software that will allow you to lock a particular file with a password but you could change the owner of the file so that only you can edit it.

If you create a file with sudo'ers permisions E.G

sudo touch helloworld.txt

Only the root user will be able to edit that file, other users will be able to open the file and view its contents but not make any modifications to that file. So to update your file you could execute these commands in a terminal.

sudo chown root /etc/dnsmasq.conf 
sudo chgrp root /etc/dnsmasq.conf 

Make sure your other accounts aren't in the sudo'ers group.

To edit this file you would have to open it with root permissions and adding sudo to the front of your command will elevate you to that level. Try this command to edit it

sudo nano /etc/dnsmasq.conf
| improve this answer | |
  • thanks for reply. The problem is: I am a man whose need restrictions. I want limit myself to edit this flle. I want add difficult password to this file, print this password and hide in the basement. (i am serious). Therefore it must be something sudo can't modify. – Sruj Sep 6 '16 at 13:40
  • By limiting to only root then you are ensuring that only you can edit the file, short of encrypting the file (which would disable the program from using it) there might be no way to achive what you are talking about, also bare in mind password protected files cant be accessed by the program unless it knows the password. – Dan Sep 6 '16 at 14:10
-1

Use GPG

Encrypt:

gpg -c --armor $FILE.txt

This will ask you for a passphrase and it will create an encrypted file $FILE.txt.asc with that .asc extension. You can then delete the original file. or your you can use GPG to create the original file.

man gpg

Decrypt:

gpg -d $FILE > output.txt

This will write the decrypted data to a file named output.txt

| improve this answer | |
  • Given he wants to get locked out from system files, this is not an option. After all, dnsmasq still needs to be able to read the configuration file. – jawtheshark Sep 6 '16 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.