Need to be able to execute 'usermod' without sudo, so that a script on a remote machine may disable and lock a userid on the instance host.
Adding 'nopasswd' and the command to the wheel group in sudoers on the instance host should work, if I'm reading the sudoers documentation correctly.
Have added %wheel ALL=NOPASSWD: /usr/sbin/usermod
via visudo to /etc/sudoers on the host:
Then running the command results in failure:
username@hostname:21:21:20 UTC - ~ $ usermod --expiredate 1 --lock $uid
usermod: Permission denied.
usermod: cannot lock /etc/passwd; try again later.
Note that 'username' in the block above is a member of wheel, and that running 'sudo usermod....' does work.
Have also tried %wheel ALL=(ALL) NOPASSWD: /usr/sbin/usermod
with the same failure.
Is there a method to fix/workaround the permission/lock issue?