0

In my server, I have 2 groups: ssh-users and su-users

ssh-users hold users I ssh to the box with. User sshu is a member of ssh-users. Once logged in to the server, I want ssh-users members to be able to perform su to an user of su-users group but don't want them to be able to su root.

su-users hold users who can do core work and want them to have rights to perform su to root or any user.

How can I achieve this on Debian?

I tried the pam_wheel.so module in /etc/pam.d/su but any group I mention there are allowed su to root.

I also tried this but with no effect: https://superuser.com/a/398087/119486

Improve this question
2
  • Having a group A whose members can log in as members of group B, having group B's members able to log in as root, and preventing members of group A from becoming root are not all possible. What are you really trying to do here?
    – Blacklight Shining
    Oct 6, 2013 at 17:46
  • @BlacklightShining I am trying to create a few users (group ssh-users) with very restricted perms on the machine. If they need to manage the web application, they need to have the rights to do so. These rights are given to su-users. Doing this primarily from the security and control point of view.
    – Ethan Collins
    Oct 6, 2013 at 18:24

1 Answer 1

Reset to default
1

This is the way su works by default. All you need to do is make sure that your root password is secure. To su to any user, you need to know that user's password. So, if your ssh-users don't have root's password, they won't be able to switch to root. As long as they have the target user's pass they will be able to su to that user.

I don't understand what else you need.

Improve this answer
5
  • You are right. But I want to block access to root in the permissions also. That's because it's a small startup. I feel that it's achievable using PAM but I am still a novice at it.
    – Ethan Collins
    Oct 6, 2013 at 19:30
  • @EthanCollins I don't know if that is possible (it may well be) I am, however, pretty sure it's not worth it. The only way they can su to root is if they know root's password. Just make sure they don't.
    – terdon
    Oct 6, 2013 at 19:31
  • Thanks for your inputs, and I get to feel it's not worth the time. I would ask you another thing I am struggling with: for a 4 member team, what all user accounts should I create and permissions to provide for better security -- is just 4 user accounts with ssh-rights and another user for web application to run enough? This is what I am thinking now, creating these 4+1 normal users (app is a normal user with shell) and have only those members concerned about the app know the app user's password. (PS: I am not a sysadmin, bear with my inexperience)
    – Ethan Collins
    Oct 6, 2013 at 19:49
  • @EthanCollins sounds good to me but I'm not a sysadmin either so I don't really know. I would recommend posting a question about that. Either here or (perhaps better) on Unix & Linux where a lot more sysadmin types hang out.
    – terdon
    Oct 6, 2013 at 19:52
  • Here's a good explanation of pam_listfile and PAM in general, which I found helpful: informit.com/articles/article.aspx?p=165226&seqNum=10
    – Ethan Collins
    Oct 8, 2013 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .