Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to grant users of the wheel group (other sysadmins) su access without being asked for password.

I know how to do it with pam in linux, but the question now is for FreeBSD. I am not familiar with the syntax for FreeBSD's PAM subsystem. What shall I enter in /etc/pam.d/su instead of the default:

auth         sufficient   pam_rootok.so   no_warn
auth         sufficient   pam_self.so     no_warn
auth         requisite    pam_group.so    no_warn group=wheel root_only fail_safe ruser
auth         include      system

# account
account      include      system

# session
session      required     pam_permit.so
share|improve this question

2 Answers 2

up vote 4 down vote accepted

I did some error and trial and the solution for me seems to be like this:

# auth
auth            sufficient      pam_rootok.so           no_warn
auth            sufficient      pam_self.so             no_warn
auth            requisite       pam_group.so            no_warn group=wheel root_only fail_safe ruser
auth            sufficient      pam_group.so            no_warn group=wheel root_only fail_safe ruser
auth            include         system

# account
account         include         system

# session
session         required        pam_permit.so

This allows members of the wheel group to su without password, but disallows non-members. (I think the two line can be consolidated into one, but I did not bother that much.)

share|improve this answer
    
You can just delete or comment out the first line, as it's overruled by the second. –  Ingmar Hupp Feb 13 '13 at 16:46

sudo is configured by sudoers file and visudo should be used to edit.

visudo -f /usr/local/etc/sudoers

Make sure you have this line uncommented:

%wheel ALL=(ALL) NOPASSWD: ALL
share|improve this answer
2  
I do not want to use sudo as it is not in FreeBSD (it is not part of the base system). I know it is possible with PAM and I want to use that. –  cstamas Mar 22 '12 at 21:49
    
OTOH: I corrected the syntax for visudo. –  cstamas Mar 23 '12 at 13:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.