Regular user doing su

Question

I'm using Ubuntu server 12.04. If a user is only a member of it's own group why he can still do su SOME_OTHER_USER ? Can I prevent this?

Answer 1

If you don't want the a user can execute "su" you can set the owner of it to "root" and the chmod to 700. Than only root can execute it.

If you want users of a special group to execute "su" you can set the group of it to - lets say - "wheel". And the chmod to 770. And put all users that have to execute "su" into the wheel group.

Answer 2

I found a solution that I like a lot:

1. sudo groupadd nosu
2. sudo usermod -a -G nosu USERNAME
3. sudo vi /etc/pam.d/su
4. uncomment line:

auth required pam_wheel.so deny group=nosu

Answer 3

I can think of two obvious explanations:

1. User still retains a login that was created before the user was removed from a group giving privilege
2. User is explicitly listed i /etc/sudoers