Prevent other admin users from changing network settings, ubuntu linux

Hi,

On an Ubuntu linux server, I would like to prevent other root users / admins from changing the network settings. I want to set a static IP address/network settings and then lock it in a way that even other admins cannot change it.

Is there a way? How can I do this?

Thank you...

From serverfault ICTdesk.net

• if these users are root, then no. However it should be possible to have layered administration using sudo and pam authentication levels using normal user accounts to perform the tasks needed day-to-day.

  To avoid simple mistakes etc, you may find setting the configuration files immutable (chattr +i) may help.

  From Sirex

• Do they have access to the machine ? If no, then it's easy. If yes, then you could create a seperate group .. let's say superadmin and the only person in that group will be you.

  How are they taking root priviledges ? Login ? sudo ? Without being totally sure, i think that SELINUX can help you assign priviledges based on the source ip.

  From Nikolaidis Fotis

• Elaborating on the answers above.

  This fellow used SELinux to secure a machine with public root access as a proof of concept. SELinux - http://www.linuxjournal.com/article/6836 However, SELinux is an adventure to learn.

  You could use the chattr +i above and just not tell them about it...depending on how clever your users are. chattr -i would allow any root user to edit the file. In addition +a allows only appending.

  The "normal" way to do this would be to create normal users and specifically give them the privleges they should have via something like the free tool Sudo.

  Nikolaidis Fotis : additionally to +i , +a for some critical confs such as /etc* try to set +u (keep a backup of the file if it's deleted). But this solution works only if you use ext* filesystem. If you use something else, i don't think that is being supported.

  Josh : -2 is unnecessary. If anything the SE Linux root security link is original and 100% relevant to OP. Would also be nice if the downvoters would comment and let me know what it was voted down for, so I could address the issue in the future.

  ICTdesk.net : Thank you, I will consider chattr +i, maybe in combination with lcap, but I will have to research this further.
  From Josh