How to only allow someone to su root?

I google it and see someone suggest to add a group,says admin, and add the specific user who can su root to that group, change the owner of /bin/su to that group and chmod o-rwx /bin/su

I try that, and yes, only the user I specify can su root, but even I input the password correcly, it can no more change to root. What's up? And what's the right way to do that?

You really don't want to have multiple root users.
Instead, have a look at the sudo command. It provides access for certain users to perform specific commands as the superuser.

man sudo and google will help you get it configured.

Thanks for reply. But I wonder if su and sudo the same thing?

su root allows a user to become the superuser.
sudo allows others to run specific commands as the superuser.

Allowing multiple users to su root means these users will know the root pwd, which can create a lot of issues.

sudo, on the other hand, is highly configurable and will allow multiple users to run commands that require root priviledges. But you retain the root user security and would be the only one that can configure these privileges. This is a much better option.

Of course, you could defeat this safeguard by configuring a user like this:
But, no ordinary user needs root access to all cmds. Not sure why you would want that.

Depending on your distro you should have a pam module called wheel. Check for /lib64/security/pam_wheel.so or /lib/security/pam_wheel.so from there only users in the WHEEL group (by default) are allowed to su to root.

More information is in the man pages: man pam_wheel

We can probably help you configure it if you want..........

Also worth noting that a number of applications allow a user to "shell out" Vi is a great example.

Therefore, if someone has access to run They can then easily go into a root shell.

And this is a fine example of why global access to commands via sudo is a really bad idea, and of how *buntu have really, really, really abused sudo.

True, but Ubuntu only gives global sudo permissions to the first user (the one created at install) thererfore it is reasonable to assume that this would have been the person to create the root account anyway.