stopping a user from using the su command

caged · 06-02-2004, 11:23 PM

hi.

anyone know how i could removethe su command from selective users?

cheers.
Ben.

Simon Bridge · 06-02-2004, 11:50 PM

You could always just not tell anyone the root password... and let users know that calls to root are logged, with the log reviewed dayly.

This always works for me.

Otherwise there is no point blocking specific users, after all, if they have to log on in the first place, they could always try logging on as root!

Simon

320mb · 06-03-2004, 12:52 AM

Slackware installs a program called sudoers.............
here is the man page.............

http://man.linuxquestions.org/index....ction=0&type=2

Chris H · 06-03-2004, 03:33 AM

I think you can remove them from the users or wheel groups, if you have them. Least that worked in Gentoo for me. Didn't mean to, I just messed up and removed myself from those groups by mistake. Only realised when I got permission denied when I tried to su.

darthtux · 06-03-2004, 12:52 PM

This should do the trick. Put it in /etc/sudoers

Code:

root:ALL EXCEPT GROUP root:DENY

Okay, that lovely smiley face is actually part of the code. A colon followed by a capital D

unSpawn · 06-03-2004, 01:06 PM

Another easy way for PAM-ified distro's is to deny specific ppl to use <service> is use something like pam_listfile.