6

I have this centos VPS with 5 accounts; then I enabled one user to ssh, disabled root login, and have shell disabled for every other user account..

Is to possible to permit root to su the other ones while ssh direct access for those users is disabled?

closed as unclear what you're asking by kasperd, mdpc, Ward, Jenny D, masegaloeh Apr 20 '15 at 9:28

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 10
    You cannot prevent root from suing to any user. – Blacklight Shining Apr 19 '15 at 14:28
  • Also note that Server Fault is explicitly for business environments. This question isn't; I've flagged it for migration to Unix and Linux. – Blacklight Shining Apr 19 '15 at 14:31
  • 1
    @BlacklightShining you can, if you use PAM. In Ubuntu's default /etc/pam.d/su is the comment: You can also add "group=foo" to the end of this line if you want to use a group other than the default "root" (but this may have side effect of denying "root" user, unless she's a member of "foo" or explicitly permitted earlier by e.g. "sufficient pam_rootok.so").. So removing the rootok line earlier and using a group of which root isn't member might prevent root from suing to another user until root learns to use sudo or usermod or any of the editors available. – muru Apr 19 '15 at 18:25
  • 1
    @muru I stand corrected. In any case, root can call setuid() and then exec(), to the same effect. – Blacklight Shining Apr 19 '15 at 18:50
11

Yes, provided that you disabled root's ssh access and not root itself.

However, for accounts with disabled shells you'll have to tell su what shell to use.

su -s /bin/bash -l $user

Not the answer you're looking for? Browse other questions tagged or ask your own question.