Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First, I am NOT looking for rock star security. We just at a glance want to prevent "sudo su -" and it is a policy here to always use sudo when running commands and we all want that. Ideally we would like to log something if someone does try "sudo su -" to please obey the culture and never become root so we can reverse engineer all commands run and what happened. Is there a way to do this to prevent sudo su - but allow "sudo su - serveruser"

thanks, Dean

share|improve this question
"we all want that" as in your organization, or as in a generalized assumption about best practices/opinion that does not always hold true (I am probably not the only one considering the ubuntu/OSX-style sudomy as helpful to safety as using a blunt saw over a sharp one is - adds complexity where you should be concentrating on the actual task at hand). – rackandboneman Dec 21 '12 at 14:15
"we all want that" as in the team wants that. clearly some places want rock star security(financial, government) so I cannot say we all want as in the world. – Dean Hiller Dec 21 '12 at 14:20
up vote 2 down vote accepted

You can specify the full "su - foouser" in the sudoers file - the entire command string must be matched, which prevents a simple "su -". On the downside, you'll have to list all acceptable destination users with separate allowed commands.

Alternately, you can use sudoers to specify groups of destination users and have them use the "sudo -U " format.

share|improve this answer

What you can do is allow specific commands to specific users. As far as I know there is no "negation" mechanism in sudo. The is only what you permit.

However, this is not directly sudo, you can activate the wheel group, and than only members of that group are allowed to switch user. See answer enable wheel to prevent sudo su.

share|improve this answer
actually, you can do negation. I have done that just this morning and tested and it works though it is not well-advised. In case of sudo whitelisting is very secure but blacklisting is usually not very secure as there are other ways to work around it and become root still in general, but all the admins have root access so they could destroy the machine anyways. – Dean Hiller Dec 21 '12 at 14:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.