Restricting su

dellthinker · 01-21-2007, 12:43 PM

Hi all, i just read a page about restricting su from other users by using the groupadd cmd.

Problem is that though i followed the instructions, im able to su root on another machine. The article i read is here

The commands i used was this:

Code:

debian:/home/user# groupadd rootmembers
debian:/home/user# usermod -G rootmembers user
debian:/home/user#

From what i can tell it worked because i didnt see any errors. However im still able to su on another computer. What am i doing wrong?

P.S.
debian:/etc# uname -a
Linux debian 2.4.27-3-686 #1 Thu Sep 14 06:30:39 UTC 2006 i686 GNU/Linux

Just in case anyone asked.

mikieboy · 01-21-2007, 02:17 PM

You've created a group called rootmembers which will determine who can su to root and added yourself (user) to that group. Naturally you will be able to su to root.

If you are the system admin then you need to be able to su to root on any machine on the system. For restricting the other users you need to edit the etc/pam.d/su file as described on the page you refer to, bearing in mind that the website is aimed at Redhat users. For Debian and other distros your /etc/pam.d/su is going to look a bit different. IMO the Debian version is sufficiently well commented to be able to work out what to do from within the file itself.