Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Ubuntu server 12.04. If a user is only a member of it's own group why he can still do su SOME_OTHER_USER ? Can I prevent this?

share|improve this question
    
So.. they know the other user's password? –  Shane Madden Aug 25 '12 at 22:03

3 Answers 3

If you don't want the a user can execute "su" you can set the owner of it to "root" and the chmod to 700. Than only root can execute it.

If you want users of a special group to execute "su" you can set the group of it to - lets say - "wheel". And the chmod to 770. And put all users that have to execute "su" into the wheel group.

share|improve this answer
up vote 1 down vote accepted

I found a solution that I like a lot:

  1. sudo groupadd nosu
  2. sudo usermod -a -G nosu USERNAME
  3. sudo vi /etc/pam.d/su
  4. uncomment line:

auth required pam_wheel.so deny group=nosu

share|improve this answer

I can think of two obvious explanations:

  1. User still retains a login that was created before the user was removed from a group giving privilege
  2. User is explicitly listed i /etc/sudoers
share|improve this answer
    
1.) The user is no longer logged in. 2.) User is not in sudoers file –  Kovica Aug 24 '12 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.