-3

I have problem with sudo and su - related.

I have set the expected results, please help me here.

Adding groups, users using below commands on server

groupadd group1  
groupadd group2  

useradd user1 -g group1  
useradd user2 -g group2  

passwd user1  
passwd user2  

I have now 2 users ready on server

192.168.1.15 - server  
[root@hdp23ambari ~]# visudo
user1 hdp23ambari = PASSWD: !/usr/sbin/visudo, /usr/bin/sudo, /bin/su
user2 hdp23ambari = PASSWD: !/bin/su - user2, !/usr/bin/sudo, !/usr/sbin/visudo

vim /etc/ssh/sshd_config  

DenyUsers root user2  
AllowUsers *@192.168.1.*  
DenyGroups  
AllowGroups  

192.168.1.10 - client  
[root@laptop Documents]# ssh user1@192.168.1.15  
user1@192.168.1.15's password:  
Last login: Thu Sep 24 00:06:33 2015 from laptop.narayana.local  
[user1@hdp23ambari ~]$ sudo su - user2 [iam able to do it - this is expected]  
[sudo] password for user1:  
[user2@hdp23ambari ~]$ exit  
logout  
[user1@hdp23ambari ~]$ su - user2  [how do we prevent 'su - ' access from visudo ? - this is unexpected results coming up]  
Password:  
[user2@hdp23ambari ~]$  

[root@laptop Documents]# ssh user2@192.168.1.15 [iam able to do it - this is expected]  
user2@192.168.1.15's password:  
Permission denied, please try again.
1
  • 1
    and what is the question/problem?
    – Jakuje
    Oct 7 '15 at 8:20
2

You have a big confusion between su and sudo. [- sudo: https://en.wikipedia.org/wiki/Sudo] [- su : https://en.wikipedia.org/wiki/Su_(Unix)]

In short story long, by doing sudo all you do is to switch into another user using your own password and you succeed (only if you have proper configuration setup in sudoers). Differently, performing "su -" you are actually switching to that user and in that case you need the password for that user, not your own password.

try to setup a password for that user and test it.

10
  • Thanks for answer. I am not confused, i stated very clearly that i wanted to stop user2 as a switch user ie. user1@..~$ su - user2 , but this i want to stop. How do i configure my sudoers file? Oct 7 '15 at 16:05
  • sorry but I don't really understand the question. As per clear statement, sudo and su are cristal clear (man su and man sudo are great help), but still I am not sure what are you trying to do at this stage.
    – ostendali
    Oct 7 '15 at 16:52
  • [user1@hdp23ambari ~]$ su - user2 [how do we prevent 'su - ' access from visudo ? - this is unexpected results coming up] Oct 8 '15 at 8:42
  • how to stop, right now allowed to switch to user2 ` [user1@hdp23ambari ~]$ su - user2 [how do we prevent 'su - ' access from visudo ? - this is unexpected results coming up] ' Oct 8 '15 at 8:43
  • you simply can't, that is why I posted for you the wiki page that defines clearly su and sudo.
    – ostendali
    Oct 8 '15 at 8:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.