3

I want to configure pam in a way so that my some users can su to only some user.

In RHEL4, I used

/etc/pam.d/su

auth       required     /lib/security/$ISA/pam_stack.so service=system-auth 
auth       sufficient   /lib/security/$ISA/pam_stack.so service=suroot-members 
auth       required     /lib/security/$ISA/pam_deny.so

/etc/pam.d/suroot-members

auth       required     /lib/security/$ISA/pam_wheel.so use_uid group=suroot
auth       required     /lib/security/$ISA/pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/sumembers-access

With above configuration users in group suroot can only su to username mentioned in sumembers-access. But with OEL6 pam_stack.so is deprecated. I tried configuring like below but it is not working as expected.

/etc/pam.d/su

auth      sufficient  pam_rootok.so
auth      include     system-auth
auth      include     group2-members
auth      include     group1-members
auth      required    pam_deny.so
account   sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account   include     system-auth
password  include     system-auth
session   include     system-auth
session   optional    pam_xauth.so

/etc/pam.d/group2-members

auth required pam_wheel.so use_uid group=group2
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access

Above is not working, All users are able to su to everyone. Can someone tell what am I doing wrong ?

4
  • 3
    Don't give your users the other accounts' passwords and use sudo instead.
    – Daniel Beck
    Jan 7, 2012 at 12:04
  • sudo is another option, I am looking forward to check what m i doing wrong. Plus these are shared account oracle & other application accounts. Jan 7, 2012 at 12:20
  • 2
    sudo -u oracle -s Jan 7, 2012 at 12:39
  • @grawity sudo is not an option for now, but i will check with concerned seniors. Jan 7, 2012 at 18:33

1 Answer 1

1

Hope this will help.

# cat /etc/pam.d/su
auth            sufficient      pam_rootok.so
auth            [default=1 success=ok ignore=ignore] pam_wheel.so trust use_uid group=group1
auth            [success=2 default=die] pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group1-access
auth            [default=die success=ok ignore=ignore] pam_wheel.so trust use_uid group=group2
auth            requisite pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access
auth            include system-auth
account              sufficient        pam_succeed_if.so uid = 0 use_uid quiet
account              include                system-auth
password             include                system-auth
session              include                system-auth
session              optional        pam_xauth.so

# cat /etc/security/su-group1-access |egrep -v "^#|^$"
oracle
user

# cat /etc/security/su-group2-access |egrep -v "^#|^$"
root

Original answer: Use Below

# cat /etc/pam.d/su |egrep -v "^#|^$"
auth        sufficient  pam_rootok.so
auth        [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup group1
auth        required pam_wheel.so use_uid group=group1
auth        required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group1-access
auth        [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup group2
auth        required pam_wheel.so use_uid group=group2
auth        required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access
auth        include     system-auth
account     sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account     include     system-auth
password    include     system-auth
session     include     system-auth
session     optional    pam_xauth.so

# cat /etc/security/su-group1-access |egrep -v "^#|^$"
oracle
user

# cat /etc/security/su-group2-access |egrep -v "^#|^$"
root
1
  • That make sense & worked perfectly, But user which are not part of any group (group1, group2) can su to anyone. How can I configure the same restrictions but if the user is not a part of any group listed above should not be able to su to anyone ? Mar 7, 2012 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .