So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system
One problem I ran into is that if a user is given local root permissions, they can in turn login as any user in the FreeIPA directory. Even if that users doesn't have access to that particular machine via HBAC rules.
Sample scenario. FreeIPA client machine PC1. Two users in FreeIPA: Bob and Alice. Alice is not allowed to access PC1 via HBAC rules. Bob has local root on PC1. Bob can su to become Alice on PC1.
The only info I can find refers to commenting out this line in /etc/pam.d/su:
auth sufficient pam_rootok.so
Which now asks local root for Alice's password if he tries to:
However, if Bob has root access he can just as easily enable the above PAM/su line.
Shouldn't FreeIPA prevent Alice's account from ever accessing PC1 whether it's via direct login attemp or local root su-ing?
How does one prevent local roots from being able to login as any FreeIPA user?