4

How do I make sure that a non-administrator user can not change his own password? I want only administrator to do that.

  • 1
    What does /etc/pam.d/passwd contain? – muru Oct 26 '16 at 6:16
  • @muru I don't know sir. Can't understand what's written there. – Raman Oct 26 '16 at 6:20
  • 2
    I didn't ask you to interpret it. Just post the contents. – muru Oct 26 '16 at 6:21
7

You can remove the SETUID bit from passwd binary:

sudo chmod u-s /usr/bin/passwd

although this is not recommended.

The /usr/bin/passwd binary is a SETUID executable with owner as root, so when passwd is executed by anyone it is run as root (so necessary changes in /etc/passwd, /etc/shadow files can be done). By removing the SETUID bit, we have removed this capability.

  • Surely passwd makes use of some kernel library function or something? Is passwd the only way to change a password? – cat Oct 26 '16 at 13:08
  • 1
    @cat There's nothing stopping you from editing /etc/shadow by hand. Eventually you just need the sufficient capability to edit /etc/shadow. – heemayl Oct 26 '16 at 13:12
  • 1
    "You can remove the SETUID bit from passwd binary" - And then a system update comes along and updates your /usr/bin/passwd, reverting your permission change... – marcelm Oct 26 '16 at 13:15
  • @marcelm Fedora last changed passwd(1) a year ago, so maybe this happens? But I think, passwd is quite a small and "finished" utility, unlikely to get updates. – cat Oct 26 '16 at 13:23
  • @marcelm If you are persistent, and if there is no security upgrade for passwd package's binaries, you can always held back the package passwd from auto-upgrading: sudo apt-mark hold passwd. Also there are many ways to automate the chmod-ing stuff if the package is upgraded. – heemayl Oct 26 '16 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.