I want to configure pam in a way so that my some users can su to only some user.
In RHEL4, I used
auth required /lib/security/$ISA/pam_stack.so service=system-auth auth sufficient /lib/security/$ISA/pam_stack.so service=suroot-members auth required /lib/security/$ISA/pam_deny.so
auth required /lib/security/$ISA/pam_wheel.so use_uid group=suroot auth required /lib/security/$ISA/pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/sumembers-access
With above configuration users in group suroot can only su to username mentioned in sumembers-access. But with OEL6 pam_stack.so is deprecated. I tried configuring like below but it is not working as expected.
auth sufficient pam_rootok.so auth include system-auth auth include group2-members auth include group1-members auth required pam_deny.so account sufficient pam_succeed_if.so uid = 0 use_uid quiet account include system-auth password include system-auth session include system-auth session optional pam_xauth.so
auth required pam_wheel.so use_uid group=group2 auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access
Above is not working, All users are able to su to everyone. Can someone tell what am I doing wrong ?