su permissions in CentOS

fantasygoat · 10-07-2010, 04:09 PM

Today I noticed that by default, any user can run su and get root privileges if they know the root password. I was under the impression they had to be a member of wheel.

This is controlled from the /etc/pam.d/su file, and I can uncomment a line in it to fix this.

However, I'd like to set the behavior when I set the machines up initially. Is there some method to set the default su behavior at setup time, or will I be forced to edit that file everytime I set a server up?

eSelix · 10-07-2010, 04:22 PM

Did your try restarting your machine? And /etc/pam.d/su has been automagically changed after your changes? Because it shouldn't.

fantasygoat · 10-07-2010, 04:30 PM

No, by default when you set up CentOS, it has su enabled for all users. I would like the behavior to be only allow su for wheel users.

I can manually edit the pam.d/su file but I was wondering if there was an option I could set when I'm setting the machine up from scratch.

eSelix · 10-07-2010, 04:43 PM

Oh, sorry, I misunderstanded your question. In Ubuntu it is possible through preseeding, but on CentOS I just don't known. Maybe other forum users will help you.