Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On a VPS I own (hosted at bluevm.com), I have three users:

  • userone, with password foo, and sudo rights.
  • usertwo, with password bar, without sudo rights.
  • root, with now password (deleted with passwd -d)

I can't use su when non-root to swicth from userone to usertwo and vice-versa, although I'm sure the password is OK since I use it to connect via ssh, and the keyboard layout seems to be OK. Also, the passwd command does not seem to work.

When connecting as userone

ssh to connect works:

$ ssh userone@example.com
userone@example.com's password: foo
Last login: blah blah

su otheruser does not work:

$ su usertwo
Password: bar
su: Authentication failure

self-su does not work:

$ su userone
Password: foo
su: Authentication failure

ssh otheruser@localhost works:

ssh usertwo@localhost
usertwo@localhost's password: 
Last login: blah blah
$ who am i
usertwo blah blah
$ exit

passwd does not work:

$ passwd
Changing password for userone.
(current) UNIX password: foo
passwd: Authentication token manipulation error
passwd: password unchanged

sudo works, and when root su otheruser works:

$ sudo -i
[sudo] password for userone: foo
# su usertwo
$ who am i
usertwo blah blah
$ exit
$ exit

When connecting as usertwo

ssh to connect works:

$ ssh usertwo@example.com
usertwo@example.com's password: bar
Last login: blah blah

su otheruser does not work:

$ su userone
Password: foo
su: Authentication failure

self-su does not work:

$ su usertwo
Password: bar
su: Authentication failure

passwd does not work:

$ passwd
Changing password for usertwo.
(current) UNIX password: bar
passwd: Authentication token manipulation error
passwd: password unchanged
share|improve this question
    
Does /var/log/auth.log get any additional info about the su authentication failure? –  circle May 12 '13 at 12:30
    
You can use sudo su - newuser –  Hennes May 12 '13 at 12:33
    
@Hennes No, not when I'm logged in as usertwo, which does not have sudo rights. –  Georges Dupéron May 12 '13 at 12:41
    
@circle when usertwo runs su userone, in /var/log/auth.log I have su[25796]: pam_unix(su:auth): authentication failure; logname=usertwo uid=1002 euid=1002 tty=/dev/pts/4 ruser=usertwo rhost= user=userone, then pam_authenticate: Authentication failure, then FAILED su for userone by usertwo, then - /dev/pts/4 usertwo:userone. –  Georges Dupéron May 12 '13 at 12:48

1 Answer 1

Some UNIX:es requires you to be member of the wheel group to be able to switch user. from wikipedia article:

Some Unix-like systems have a wheel group of users, and only allow these users 
to su to root.[1]
This may or may not mitigate these security concerns, since an intruder might
first simply break into one of those accounts. 

Check weather your otheruser are a member, and maybe compare id userone with id usertwo and see if maybe userone is a member of groups which usertwo are not, granting extra privileges.

share|improve this answer
    
Interesting insight. I tried adding both users to the same list of groups, but without success (also, I can't su from userone to userone itself). The system does not have a wheel group (it is a Debian GNU/Linux 6.0.7 (squeeze) system), but I'll try to investigate that idea further. –  Georges Dupéron May 12 '13 at 21:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.