I'd like to add a /etc/sudoers
rule to allow any user from group admin
to login as a user from group users
.
Example:
In group admin
I have: alan
and smith
. In group users
: anna
, mike
. And other users: stephen
, nick
.
alan
and smith
can do this:
sudo su - anna
sudo su - mike
But the can't do this:
sudo su -
sudo su - root
sudo su - stephen
I vainly tried something like this:
%admin ALL=(ALL) NOPASSWD:/bin/su - %users
Any ideas?
P.S. it would be ideal if complied with one more dependency:
alan
is also in users
group and smith
can't do:
sudo su - alan
because alan
is in admin
group.
sudo su
, usesudo -u alan
.