Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to configure pam in a way so that my some users can su to only some user.

In RHEL4, I used

/etc/pam.d/su

auth       required     /lib/security/$ISA/pam_stack.so service=system-auth 
auth       sufficient   /lib/security/$ISA/pam_stack.so service=suroot-members 
auth       required     /lib/security/$ISA/pam_deny.so

/etc/pam.d/suroot-members

auth       required     /lib/security/$ISA/pam_wheel.so use_uid group=suroot
auth       required     /lib/security/$ISA/pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/sumembers-access

With above configuration users in group suroot can only su to username mentioned in sumembers-access. But with OEL6 pam_stack.so is deprecated. I tried configuring like below but it is not working as expected.

/etc/pam.d/su

auth      sufficient  pam_rootok.so
auth      include     system-auth
auth      include     group2-members
auth      include     group1-members
auth      required    pam_deny.so
account   sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account   include     system-auth
password  include     system-auth
session   include     system-auth
session   optional    pam_xauth.so

/etc/pam.d/group2-members

auth required pam_wheel.so use_uid group=group2
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access

Above is not working, All users are able to su to everyone. Can someone tell what am I doing wrong ?

share|improve this question

migrated from stackoverflow.com Jan 7 '12 at 12:00

This question came from our site for professional and enthusiast programmers.

3  
Don't give your users the other accounts' passwords and use sudo instead. –  Daniel Beck Jan 7 '12 at 12:04
    
sudo is another option, I am looking forward to check what m i doing wrong. Plus these are shared account oracle & other application accounts. –  user1116993 Jan 7 '12 at 12:20
2  
sudo -u oracle -s –  grawity Jan 7 '12 at 12:39
    
@grawity sudo is not an option for now, but i will check with concerned seniors. –  user1116993 Jan 7 '12 at 18:33

1 Answer 1

up vote 0 down vote accepted

Hope this will help.

# cat /etc/pam.d/su
auth            sufficient      pam_rootok.so
auth            [default=1 success=ok ignore=ignore] pam_wheel.so trust use_uid group=group1
auth            [success=2 default=die] pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group1-access
auth            [default=die success=ok ignore=ignore] pam_wheel.so trust use_uid group=group2
auth            requisite pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access
auth            include system-auth
account              sufficient        pam_succeed_if.so uid = 0 use_uid quiet
account              include                system-auth
password             include                system-auth
session              include                system-auth
session              optional        pam_xauth.so

# cat /etc/security/su-group1-access |egrep -v "^#|^$"
oracle
user

# cat /etc/security/su-group2-access |egrep -v "^#|^$"
root

Original answer: Use Below

# cat /etc/pam.d/su |egrep -v "^#|^$"
auth        sufficient  pam_rootok.so
auth        [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup group1
auth        required pam_wheel.so use_uid group=group1
auth        required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group1-access
auth        [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup group2
auth        required pam_wheel.so use_uid group=group2
auth        required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access
auth        include     system-auth
account     sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account     include     system-auth
password    include     system-auth
session     include     system-auth
session     optional    pam_xauth.so

# cat /etc/security/su-group1-access |egrep -v "^#|^$"
oracle
user

# cat /etc/security/su-group2-access |egrep -v "^#|^$"
root
share|improve this answer
    
That make sense & worked perfectly, But user which are not part of any group (group1, group2) can su to anyone. How can I configure the same restrictions but if the user is not a part of any group listed above should not be able to su to anyone ? –  user1116993 Mar 7 '12 at 18:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.