8

Is there any way to allow non-root users to change other user's password. Specifically, is there a way to grant help desk employees the ability to do password resets. The help desk already can reset Windows passwords, which is easy to delegate out.

These are on a variety of server types, although most on HP-UX. Unfortunately, the applications that run on the server prevents us from using LDAP, so these servers are independent and users forget their passwords. Often. Requiring a server admin who knows the root password, especially in the middle of the night, is a waste of resources.

If it is possible, does it also prevent the user from changing root, like Windows prevents users from changing admin passwords from non-admin accounts.

Ben Pilbrow
  • 12,041
  • 5
  • 36
  • 57
Brian
  • 103
  • 1
  • 6

4 Answers4

10

Look at sudo:

http://www.gratisoft.us/sudo/

dmourati
  • 25,540
  • 2
  • 42
  • 72
8

Add a group called helpdesk and add all heldesk users to it. Then add the following to sudoers file.

%helpdesk ALL=/usr/bin/passwd

Now they can sudo to change passwords but nothing else.

Jim
  • 398
  • 2
  • 9
1

Given that HP-UX is said to support PAM, I dare to mention the following tentative clean approach to solving this problem here:

use pam_tcb (tcb - the alternative to /etc/shadow), and there'll be users' password files per user -- they can be manipulated without root's rights (in fact, in Owl, passwd isn't setUID root), and you can give the permission to modify the passwords of certain users (and not the other ones, say, "root") to a specific group (by simply modifying the permissions of the shadow files).

But it's not a practical ready solution yet probably, because I don't see a port of pam_tcb to HP-UX.

imz -- Ivan Zakharyaschev
  • 137
  • 1
  • 1
  • 14
-1

Update: Nevermind, passwd is already setuid root. Oops.

You could give the setuid attribute to the passwd program. Just do 

sudo chmod u+s `which passwd`

Then make sure only certain users can use it so change the group and restrict permissions:

sudo chgrp password_reset_delegates `which passwd`
sudo chmod 770 `which passwd`

And add your users to that group

sudo adduser frank password_reset_delegates
sudo adduser barbara password_reset_delegates

You may want to make a copy of the passwd program without the setuid so that other users can change their own password.

Alternatively, you could set up sudo and allow sudo access to only the passwd program for the helpdesk users.

James
  • 819
  • 4
  • 10