I'm using Ubuntu server 12.04. If a user is only a member of it's own group why he can still do su SOME_OTHER_USER ? Can I prevent this?

  • So.. they know the other user's password? – Shane Madden Aug 25 '12 at 22:03

If you don't want the a user can execute "su" you can set the owner of it to "root" and the chmod to 700. Than only root can execute it.

If you want users of a special group to execute "su" you can set the group of it to - lets say - "wheel". And the chmod to 770. And put all users that have to execute "su" into the wheel group.

| improve this answer | |

I found a solution that I like a lot:

  1. sudo groupadd nosu
  2. sudo usermod -a -G nosu USERNAME
  3. sudo vi /etc/pam.d/su
  4. uncomment line:

auth required pam_wheel.so deny group=nosu

| improve this answer | |

I can think of two obvious explanations:

  1. User still retains a login that was created before the user was removed from a group giving privilege
  2. User is explicitly listed i /etc/sudoers
| improve this answer | |
  • 1.) The user is no longer logged in. 2.) User is not in sudoers file – Kovica Aug 24 '12 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.