Stop User From Changing Root Password

[shy001]

Hi all
How can you stop users from changing the root user Password?

 

[The_Unbeliever]

By making it fiendishly difficult, and remove sudo rights from all users.

 

[Kasyx]

Removing the user from the "wheel" group, and setting the ownership on the "passwd" script to root - although this will prevent users from being able to change their own passwords.

 

[shy001]

is there any way users can change their own passwords but not root users password?

 

[Kasyx]

is there any way users can change their own passwords but not root users password?

Yes - remove them from the "wheel" group and ensure they don't have sudo access.

Changing ownership of the "passwd" script to the root user is the only thing that will prevent the users from changing their own passwords, however this is not necessary, merely useful for added security.

 

[Gothan]

ok my question is how did the user obtain the root password? Dont you need the root password to be able to change it?

 

[The_Unbeliever]

ok my question is how did the user obtain the root password? Dont you need the root password to be able to change it?

Yup, you do.

Maybe it was a dictionary attack? Or the password was easy to guess?

 

[shy001]

apparently all you need to do to change the root password is type "su" to become root, then type "passwd" and it will prompt you for a new password.

i have not had experience with this
i am researching it and have no linux machine to experiment with
thats y i am asking

 

[milomak]

When I use su or su - on other distros besides ()ubuntu, you need to type in the root password.

 

[shy001]

"In order to change the root password, a user must type passwd. The user will be prompted to type in the new password and confirm it.
It will then prompt you to type your new pass, and then to confirm it."

Ok here is another problem:Wireless freezing kernel on laptop at irregular intervals

 

[Gothan]

Even with sudo on kubuntu you still need the root password before you can run sudo anything

 

[Tux]

I've found that preventing users from changing their passwords themselves is on par with taking a gun from them when they want to shoot themselves in the foot

 

[Kasyx]

Even with sudo on kubuntu you still need the root password before you can run sudo anything

No you don't. You need your user password which is used to sudo

so if your username is "foo" and your username's password is "bar", to change the root password, you just type:

sudo passwd
[sudo] Enter password for foo: bar
Enter UNIX password: newpassword

As long as you have sudo access or are able to get dropped into a root shell (i.e. UID0 hack), then you can change the root password without needing to know it in the first place.

 

[chiskop]

I've found that preventing users from changing their passwords themselves is on par with taking a gun from them when they want to shoot themselves in the foot

Wait, you haven't told us whether you think it is a good idea or not?

 

[shy001]

ok but i wana know how to STOP users from changing the root user password

 

[superfly]

On Ubuntu-based systems, only the first user by default can use sudo. All subsequent users cannot, unless you add them to the "admin" group ("wheel" is from BSD). If you're not in the admin group, sudo won't work.

 

[Kasyx]

ok but i wana know how to STOP users from changing the root user password

*sigh*

Removing the user from the "wheel" group, and setting the ownership on the "passwd" script to root - although this will prevent users from being able to change their own passwords.

Yes - remove them from the "wheel" group and ensure they don't have sudo access.
Changing ownership of the "passwd" script to the root user is the only thing that will prevent the users from changing their own passwords, however this is not necessary, merely useful for added security.

As long as you have sudo access or are able to get dropped into a root shell (i.e. UID0 hack), then you can change the root password without needing to know it in the first place.

REMOVE. FROM. WHEEL. GROUP.

 

[chiskop]

ok but i wana know how to STOP users from changing the root user password

If you're on ubuntu, remove them from the sudo'ers group:

System > Administration > Users and Groups > [enter password] > Manage groups > admin > Properties > (Make sure that only users that should be able to run as root are ticked).

 

[The_Unbeliever]

foobar

 

[shy001]

lol thanx
sorry - blonde moment

ok another question "Linux Log in problems when booting up"