Hi,

I have a product called Bindview (anyone familiar with it) that in its latest version 8.02 has the ability to run in an agentless mode. Basically this is a reporting tool for Linux and other os's.

What it needs to do though as near as I and my Bindview Administrator can figure out is to SSH into a server (I created the id bvagentless) and then su - to a root equivalent (for obvious reasons I'm not giving out the root password) in order to successfully run the reports. What I'm not sure how to do is to restrict the ability to su to that user only to the user account bvagentless. I will be restricting that root equivalent so it can only be used via su -.

I believe that I can use pam to do this but have confused myself trying to figure it out. I would need to be able to configure this on RHEL 2.1, 3 and 4.

Any help is much appreciated.

If you're sure that you will not be needing su for anyone else you could switch su's permissions to 755 by removing the sticky bit which is there initially.

Once this is done you could change ownership of su by allowing it to be owned by this user who will be su'ing to root. That way no-one else would be able to use this command.

This though is a dirty way of doing it and might break something else sometime in the future. So you might want to look at sudo... man sudo for information and allow the su command to be run only by this specific user.

If there's a better way of doing this I'd love to hear it.

Cheers
Arvind

man suauth