Only specific users allowd to SU?

keysorsoze · 04-26-2006, 09:14 AM

Hi! is there any way I can limit SU to a single particular user that I would like to have super user access and deny everyone else the ability to use the command?

Thanks.

Lenard · 04-26-2006, 09:24 AM

First 'su' is short for (roughly) switchuser not supersuser.....

And yes it is (already)limited to those that know the correct password(s). Keeping a hard to guess memorized root password works wonders.

When using 'su' or 'su -' without supplying a username root is used as the default user to switch to.

mikeyt_333 · 04-26-2006, 09:38 AM

edit /etc/pam.d/su and do the following:

Code:

# Uncomment the following line to require a user to be in the "wheel" group.
auth       required     /lib/security/$ISA/pam_wheel.so use_uid

Then add the user you want to be the only one to access su to the wheel group:

Code:

$ gpasswd -a [user] wheel

HTH,
Mike.

tr4nsfix · 04-26-2006, 11:04 AM

You can also use the sudo package for this.

With sudo you can specify the users or groups which have access to specific commands.
For example your /etc/sudoers might look something like this:

Cmnd_Alias SU_ACCESS = /bin/su -
User_Alias SU_USERS = bob, john, sam, fred

SU_USERS ALL = (ALL) SU_ACCESS

In this case the user(s) would have to run the following to su to the root user:
sudo /bin/su -

keysorsoze · 04-26-2006, 12:10 PM

Thanks the PAM solution looks like its the best solution for my scenario. Thanks