I am a system auditor with very limited knowledge of Linux OS. I am currently auditing a RHEL 7 server and found out that a group of users are authenticating through LDAP and using 'su' through PAM. I'd like to know the interpretation of the following file content and where can I view their access logs.
etc/pam.d/su #%PAM-1.0 auth sufficient pam_rootok.so auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup bdbadmin auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-bdbadmin-access auth required pam_wheel.so use_uid group=bdbadmin auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup wheel auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-wheel-access auth required pam_wheel.so use_uid group=wheel "# Uncomment the following line to implicitly trust users in the "wheel" group. "#auth sufficient pam_wheel.so trust use_uid "# Uncomment the following line to require a user to be in the "wheel" group. "#auth required pam_wheel.so use_uid auth substack system-auth auth include postlogin account sufficient pam_succeed_if.so uid = 0 use_uid quiet account include system-auth password include system-auth session include system-auth session include postlogin session optional pam_xauth.so
As per my understanding, the users in group bdbadmin are allowed to su access but I don't know where to look for a sudoers list or their access logs.
Thanks in advance.