0

I'm using Ubuntu server 12.04. If a user is only a member of it's own group why he can still do su SOME_OTHER_USER ? Can I prevent this?

1
  • So.. they know the other user's password? Aug 25, 2012 at 22:03

3 Answers 3

2

I found a solution that I like a lot:

  1. sudo groupadd nosu
  2. sudo usermod -a -G nosu USERNAME
  3. sudo vi /etc/pam.d/su
  4. uncomment line:

auth required pam_wheel.so deny group=nosu

1

If you don't want the a user can execute "su" you can set the owner of it to "root" and the chmod to 700. Than only root can execute it.

If you want users of a special group to execute "su" you can set the group of it to - lets say - "wheel". And the chmod to 770. And put all users that have to execute "su" into the wheel group.

0

I can think of two obvious explanations:

  1. User still retains a login that was created before the user was removed from a group giving privilege
  2. User is explicitly listed i /etc/sudoers
1
  • 1.) The user is no longer logged in. 2.) User is not in sudoers file
    – Kovica
    Aug 24, 2012 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .