How can I prevent a user from changing their password?

Question

I want to prevent a user from changing their own password. Additionally, if possible, I want to prevent them from changing it via sudo.

A good question, I look forward to seeing the answers... I haven't go a clue :) — Simon, Jun 10 '13 at 14:07
If they can use sudo, then you can't prevent them from doing anything. — psusi, Jun 10 '13 at 14:15
Probably @psusi was talking about default sudo config, i.e. the user is member of sudo group. — Eric Carvalho, Jun 10 '13 at 16:24
The only way I know of to restrict root (sudo) would be to use apparmor. See http://ubuntuforums.org/showpost.php?p=9799756&postcount=5 (you will have to modify that for your needs). — Panther, Jun 10 '13 at 18:06

Eric Carvalho · Answer 1 · 2013-06-10T16:34:05.700

Change the password minimum age:

sudo chage -m 99999 <username>

If the user is clever enough and he has sudo priviledges, you'll have a hard time trying to stop him. If you remove passwd permissions he could fix it running sudo chmod u+xs /usr/bin/passwd. If you rename passwd file he could fix it running sudo apt-get install --reinstall passwd.

I think all you could do is to give a group (or a user) the rights to run specifics commands. If you allow them to run arbitrary commands and you try to deny them running specific commands like passwd, bash or anything "harmful", that could be easily bypassed by cp /bin/bash ~/myshell; sudo ./myshell.

Simon · Answer 2 · 2013-06-10T14:22:22.637

1

To avoid a user from running the passwd command, just make it non-executable for everyone but root.

sudo chmod o-x /usr/bin/passwd

Don't forget, there are more ways to change a password other than with Terminal!

Also visit https://help.ubuntu.com/community/BasicChroot to see if this helps

edited Jun 10 '13 at 14:22

answered Jun 10 '13 at 14:14

Simon

4,813
8
35
52

score 1 · Answer 3 · answered Jun 10 '13 at 14:14

1

chmod u-s /usr/bin/passwd

might work

answered Jun 10 '13 at 14:14

KamikazeCZ

143
12

score 0 · Answer 4 · answered Jun 10 '13 at 15:34

0

You could install

ninja

but be carefully with configurating it.

When you configurate it wrong, then you are one level deeper and may not work as admin any more resp. you might then be not allowed any more to use terminal/shell/konsole as before !

answered Jun 10 '13 at 15:34

dschinn1001

3,829

How can I prevent a user from changing their password?

4 Answers4