Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured PAM authentication on Linux box to restrict particular group only to login.

I have enabled pam and ldap through authconfig and modified access.conf like below,

[root@test root]# tail -1 /etc/security/access.conf
- : ALL EXCEPT root test-auth : ALL

Also modified sudoers file, to get su for this group

[root@test ~]# tail -1 /etc/sudoers
%test-auth               ALL=/bin/su</code>

Now, only this ldap group members can login to system.

However when from any of this authorized user, I tried for su, it asks for password and then though I enter correct password it gives message like Incorrect password and login failed.

/var/log/secure shows that user is not having permission to get the access, but then it should print message like Access denied.The way it prints for console login.

My functionality is working but its no giving proper messages. Could anyone please help on this.

My /etc/pam.d/su file,

[root@test root]# cat /etc/pam.d/su
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so
share|improve this question
Are you using sudo su or just su? Which user's password are you entering? What user are you trying to change to? –  Shane Madden Oct 13 '12 at 21:06
I am using just su. I am trying to login with user which is restricted through pam config through access.conf –  skimeer Oct 15 '12 at 17:49
What SPECIFIC error message are you receiving? There are no error messages "like" Access Denied or Incorrect username/password - the message is or is not something... –  voretaq7 Oct 19 '12 at 18:39
When I tried to do su for user which has access denied, it ask me for password and then give Incorrect username/password. So as you said, there is NO Message displayed then. –  skimeer Oct 22 '12 at 18:28
add comment

migrated from stackoverflow.com Oct 13 '12 at 20:19

This question came from our site for professional and enthusiast programmers.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.