Linux Sudo Restriction

Posted by Planet Malaysia on August 6, 2008

Question: How can I make extra sudo restriction on Linux?

Solutions:
Type: visudo
insert a line
#Disable sudo su -
username ALL=(ALL) ALL, !/bin/su, !/bin/su -, !/bin/su – *
test ALL=(ALL) ALL, !/bin/su, !/bin/su -, !/bin/su – *

#Disable reset root password
username ALL=(ALL) ALL, !/usr/bin/passwd root
test ALL=(ALL) ALL, !/usr/bin/passwd root

#Disable visudo
username ALL=(ALL) ALL, !/usr/sbin/visudo
test ALL=(ALL) ALL, !/usr/sbin/visudo

Save and exit.

Basically you can combine the example as above into single if apply to same username.
For an example:
test ALL=(ALL) ALL, !/bin/su, !/bin/su -, !/bin/su – *, !/usr/bin/passwd root, !/usr/sbin/visudo

Possibly Related Posts:

« SFTP connection error

Categories How's To, Open Source, Tips