I am currently using Debian 7 (Wheezy) and I am trying to disable the su command only when the target user is root and not a privileged user.

For example, let's suppose the following users exist: root, public, privileged.

root would of course be able to su, without restrictions.

public should be able to su to privileged but not to root.

privileged should be able to su to root (or any user).

So far I have only been able to disable su to anyone but root and privileged, appending to /etc/pam.d/su the following line:

auth required pam_wheel.so 1005

Assuming 1005 is privileged uid.

However, this makes public unable to use su.

How could I make it?

Thank you!

  • Should public be able to su to other users in the system? Should public→privileged require password? Should privileged→root require password? – user1686 Mar 29 '14 at 12:07
auth sufficient pam_rootok.so
auth sufficient pam_succeed_if.so use_uid user = privileged
auth requisite  pam_succeed_if.so uid > 0
auth requisite  pam_unix.so

You could do this with sudo in an easier way:

privileged    ALL=(ALL:ALL) ALL
public        ALL=(privileged) ALL
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.