Require a password from a passwordless user when trying to become root

Ask Fedora
1

Given a standard Fedora KDE 44 installation, I have a user that resents passwords, so his/her account is passwordless, i.e.

passwd -d $user

was run for the $user account.

But I still need this user to be able to perform administrative tasks (use Discover for upgrades, mount USB pens or disks, for instance), so I need to protect his/her becoming root in some way.

sudo is not appropriate for this, as it requests the user’s password, which is none, so it carries on with the given task without any question :cross_mark:
su on the other hand, which would be the logical choice, is not on SELinux’s liking. I have to keep SELinux in permissive mode, but It produces an annoying warning (about “chkpwd” or something).

Any ideas, other than disabling SELinux altogether?

2

That’s a really bad idea.

Just to clarify, you want the user to be able to do some administrative tasks, but not all, so not full root?

3

sudo is not appropriate for this, as it requests the user’s password

You can use NOPASSWD for this specific user in /etc/sudoers and list what commands they can run via sudo and without entering a password. Will that work?

username     ALL=(ALL:ALL): /bin/kill, /bin/ls, /usr/bin/lprm
4

The sudo was specifically created to allow a specific user to be able to run a specific set of command as a specific other user.

user ALL = (specialuser) NOPASSWD: /usr/local/bin/specialcommandname

allows the user named “user” to run as “specialuser” but only the command “/usr/local/bin/specialcommandname”.

5

Thank you all for the replies.

I need the user to be able to execute anything as root, as I do not want to introduce exceptions by hand in the sudoers file(s) each time the user encounters a legitimate need. The machine belongs to that person, I have to let them him/her do whatever they want but just cannot let him/her become root without any sort of guard. And that goes even if I allowed them to execute only certain commands.

6

That’s mutually exclusive. If he can do everything he wants, he is root equivalent from a security standpoint.

7

Right, but not before proving he/she knows a secret. Remember that the user account has no password.

9

I need the user to be able to execute anything as root

You can do that too. As other mentioned it is effectively making that user root though.

username ALL=(ALL:ALL) ALL

10

You could also add the line

Defaults    rootpw

to /etc/sudoers somewhere near the top.

This will cause sudo to ask for the root password instead of the user’s password.
You then need to create a password for root, of course.

11

This will cause sudo to ask for the root password instead of the user’s password.

Thanks, I’ll try this and get back. But then what would be the difference between sudo su - and su? Actually, isn’t the correct solution to convince SELinux to allow su?

12

The “correct” thing to do, would be to just set a password for the user account and then use sudo as normal. Or you can activate the root account and allow them to su - to root and execute whatever commands they need.

You are overly complicating this by allowing the user to have no password set, and then trying to create a Rube Goldberg machine to force a password prompt when elevating permissions.

I suppose your other options would be to look at pkexec or run0, but I suspect you’ll have similar issues there.

13

You may set a password for the user account with sudo permission, but also set the system to “automatically log in” so normal computer users won’t be asked for user password (only when they do something that requires root).

This is an article about how to do it on Ubuntu, I expect it to be similar on Fedora though:

Note that this setup comes with certain caveats, most importantly the desktop environment won’t be able to unlock the user keyring automatically in this case, unless provided with user’s password or the password is blank (insecure).

image
image1060×808 95.8 KB

su should work with SELinux on enforcing mode, if root password is set. If that isn’t the case… I don’t know what exactly happened to your computer, but it seems to be very wrong.

14

Hi A C,

Welcome to Fedora!

After reading all of the current posts here, I am inclined to say to that user that resents passwords “Get over yourself!!” Particularly if this “resentful” user is to do any kind of admin task … UNLESS … that “resentful” user is the actual owner of the device (then I would just refuse to support them after the install without charging them some ungodly amount of money as a support fee)…