0

I am a system auditor with very limited knowledge of Linux OS. I am currently auditing a RHEL 7 server and found out that a group of users are authenticating through LDAP and using 'su' through PAM. I'd like to know the interpretation of the following file content and where can I view their access logs.

etc/pam.d/su

#%PAM-1.0
auth        sufficient  pam_rootok.so
auth           [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup bdbadmin
auth           required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-bdbadmin-access
auth           required pam_wheel.so use_uid group=bdbadmin
auth           [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup wheel
auth           required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-wheel-access
auth           required pam_wheel.so use_uid group=wheel

"# Uncomment the following line to implicitly trust users in the "wheel" group.
"#auth      sufficient  pam_wheel.so trust use_uid
"# Uncomment the following line to require a user to be in the "wheel" group.
"#auth      required    pam_wheel.so use_uid

auth        substack    system-auth
auth        include     postlogin
account     sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account     include     system-auth
password    include     system-auth
session     include     system-auth
session     include     postlogin
session     optional    pam_xauth.so

As per my understanding, the users in group bdbadmin are allowed to su access but I don't know where to look for a sudoers list or their access logs.

Thanks in advance.

0

Welcome to StackExchange, and in particular to SuperUser.

  1. The access log is located in /var/log/auth.log, and of course it can only be viewed by root.

  2. The command to list all members of a given group is members, if it is installed in your machine (it is not by default),

    members sudo
    

    or you can directly parse the /etc/group file which contains the relevant information,

    grep /etc/group sudo
    

    and you can double-check that with

    group UserName
    

to see all groups UserName belongs to.

  1. As for PAM and the file su, you should know that by default PAM uses a configuration file located in /etc/pam.conf unless the directory /etc/pam.d/ is not empty (your case), in which case the directory content has higher precedence. The syntax of the entries is best learned by referencing the manual here; this Web page first discusses the syntax of the /etc/pam.conf file, then that of the /etc/pam.d/ directory, which is marginally different (and now you see why I had to mention the difference above).

If you have a specific question about the content of the ruleset in su above, which after reading the Manual appears quite transparent to me, I will be happy to answer it, if I can.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.