How can I lock files with specific passwords on mac, ideally through terminal?

Question

I want to lock my /etc/hosts file so that you need a password in order to write. I know you can encrypt files with Disk Utility, but in this case the file needs to be read by the computer and the path/extension cannot change. I don't just want to lock the contents, I want to lock this file very specifically.

If I run sudo vim /etc/hosts I need to type my login password but can then do whatever I want.

I want a solution where if I run sudo vim /etc/hosts, I must type a customized/specific password to write to the file.

Answer 1

The /etc/hosts needs to be readable by other program in order to fulfill its purpose. If you encrypt the file in any way, those other programs will not be able to read the file - and it will stop working.

So in short, you cannot do this (i.e. encryption) in a meaningful manner.

However what you can do is ensure that others do not have passwords for administrative accounts on your Mac. If they do need more privileges for something, make it so that you assign access to that specific resource (for example via a sudo access limited to a specific program) - and ensure that you do not give out full administrative access.

An example of using sudo for giving access to edit a file is to use the "sudoedit" option in sudo. This allows you to give another person access to edit a file without letting their editor run as the privileged user (which is bound to let them "escape" and allow them to other things as the privileged user). It is achieved by copying the privileged file into a separate location, letting the user run their usual editor under their own user id to edit that file, and then copying its contents over the privileged file afterwards.

In sudoers you would specificy something like:

username  sudoedit /etc/hosts

By default this will allow "username" to edit that file, and requires him to enter his own login password before doing so.

If you want to the user to input a different password, that is not his login password, you have basically two ways of going about it.

One way is not to use "sudoedit": Instead create a custom program (can be a shell script) that simply inputs a string and checks that it matches the password you want, and then just mimics what sudoedit does. It can also be quite simple and just a "cp" command to copy over a specific path from the user's own home folder to /etc/hosts.

The alternative is to modify which passwords sudo will accept as valid. This is done by editing /etc/pam.d/sudo and uncommenting the standard lines beginning with "auth". Instead provide the authentication module and options you want to approve.

If you want to do something completely custom, you can compile your own PAM module that simply asks for a password and checks that it is a specific string. You can start with the source code for the default pam_opendirectory PAM module and simply rip out the OpenDirectory parts and replace it with a simple strcmp(). The source code for such a custom module is very few lines of code.

You can find the pam_opendirectory PAM module source code here:

https://opensource.apple.com/source/pam_modules/pam_modules-76/pam_opendirectory/pam_opendirectory.c.auto.html

Answer 2

Ok, so here's a completely fresh answer that's not a "half-solution".

Whether this is what you actually are looking for, you can tell me.
But to reinforce the answers above:

1. Change your default account to a non-administrator account.
2. Create a new administrator account, with a unique password; this account will only every be used to edit /etc/hosts.
3. Write a wrapper script/shell function to wrap/supersede sudo, also checking the arguments in $@ here to ensure /etc/hosts is the file in question.
4. read the password for the unique admin user into a shell variable.
5. Use the rest of the script to su to the admin user using that password, then then again to /usr/bin/sudo vi /etc/hosts.

You will then have a solution where when you "run sudo vim /etc/hosts, [you] must type a customized/specific password to write to the file."

Answer 3

Assuming your account is an administrator account, I think your best bet would be to Enable the Root User (with its own password, and remove the admin group from the sudoers file.

1. Open Directory Utility. There might be a way to do this from the Terminal, but open Directory Utility.app you can get to it via

   • System Preferences > Login Options > Network Account Server > Join...

   • open -a "Directory Utility"

   • etc... (it lives in /System/Library/CoreServices/Applications)

2. Click the lock, then under the Edit Menu, select "Enable Root User".

3. Set a unique password.

4. Make sure this works. In your terminal, type su root, and enter your new root password. You should be able to edit your hosts file.

5. In your terminal (as default user), type sudo visudo, (enter your password).

6. Comment out the line:

%admin ALL = (ALL) ALL

to

## %admin ALL = (ALL) ALL

7. Save the file.

Try this again. You should now get an error to the effect of:

8. [User] is not in the sudoers file. This incident will be reported.

---

This is not exactly file-specific, but it seems like what you were going for?

(To restore, use su root, not a sudo-related function).