Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How is it possible that I cannot log in as root by su root or su (I get incorrect password error), but I can log in by ssh root@localhost or ssh root@my_local_IP with the same password?

I'm using CentOS 6.4.


Update1 :

cat /etc/pam.d/su

gives:

#%PAM-1.0
auth        sufficient  pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth       sufficient  pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth       required    pam_wheel.so use_uid
auth        include     system-auth
account     sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account     include     system-auth
password    include     system-auth
session     include     system-auth
session     optional    pam_xauth.so

Update2 :

$ sudo grep su /var/log/secure | grep -v sudo

gives :

Feb 23 13:12:17 fallah su: pam_unix(su:auth): authentication failure;
logname=fallah uid=501 euid=501 tty=pts/0 ruser=fallah rhost=  user=root

repeated about 20 times.

share|improve this question
1  
Try clearing out the file /etc/securetty (cp /etc/securetty{,.old}; : > /etc/securetty). If that still doesn't work, provide the content of /etc/pam.d/su. –  Patrick Feb 23 at 10:48
    
no it doesn't work . –  Alireza Fallah Feb 23 at 10:52
2  
Surely with ssh 192.168.1.218 you are just logging in as yourself? To log in as root via ssh would normally need ssh root@192.168.1.218 or ssh root@localhost. –  Graeme Feb 23 at 11:42
1  
Get the PID (12345) of your shell (echo $$), open (e.g. via ssh) a root shell (necessary for tracing SUID binaries) and start strace for that shell: strace -o su.strace -p 12345 -f and look for strange errors before the error message. Or copy the last 30 lines before the error message into your question if you are not familiar with that kind of output. –  Hauke Laging Feb 23 at 12:43
2  
OK, that's the reason it isn't working. /bin/su needs to have its setuid bit on so that when ordinary (non-root) users use it, it will have access to the password list in /etc/shadow. Type, as root, chmod 4755 /bin/su to fix this. –  Mark Plotnick Feb 26 at 9:08

2 Answers 2

up vote 5 down vote accepted
+50

In your comment, you said that /bin/su has the following mode/owner:

-rwxrwxrwx. 1 root root 30092 Jun 22 2012 /bin/su

There are two problems here.

  • it needs to have the set-uid bit turned on, so that it always runs with root permissions, otherwise when an ordinary (non-root) user runs it, it will not have access to the password info in /etc/shadow nor the ability to set the userid to the desired new user.

  • it ought to have the group and other write bits turned off, so that other users cannot alter it.

To fix this, login as root - you said you can do this with ssh- and type

chmod 4755 /bin/su

or, alternatively,

chmod u+s,g-w,o-w /bin/su

(The standards document for chmod goes into more detail about what kinds of arguments it takes.) This will restore the mode bits to the way they were when the operating system was first installed. When you list this file, it ought to look like this:

-rwsr-xr-x. 1 root root 30092 Jun 22 2012 /bin/su
share|improve this answer
1  
I usually use like : chmod 755 /bin/su , what is the extra 4 for ? –  Alireza Fallah Feb 26 at 9:36
    
The 4 in the first position represents the set-uid permission. I've edited my answer to add an alternative way to use chmod using symbolic names for the permission bits. Hopefully that will be more clear. –  Mark Plotnick Feb 26 at 9:44
    
thank you very very much. I now figured out that I executed the chmod -R 777 /bin by mistake, and that's why I have been cursed :D –  Alireza Fallah Feb 26 at 9:47
    
I also asked another question, would you please see it, maybe you know the answer. –  Alireza Fallah Feb 26 at 10:08
    
cyberciti.biz/tips/… describes how to use rpm to restore file permissions, but I have not tried it. –  Mark Plotnick Feb 26 at 10:26

1. wheel group?

This is likely because your useid is not in the wheel group. On Red Hat distros you can explicitly disallow users who are not in this group from running the su command.

Here's what the su PAM configuration looks like by default:

$ more /etc/pam.d/su
#%PAM-1.0
auth        sufficient  pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth       sufficient  pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth       required    pam_wheel.so use_uid
auth        include     system-auth
account     sufficient  pam_succeed_if.so uid = 0 use_uid quiet
account     include     system-auth
password    include     system-auth
session     include     system-auth
session     optional    pam_xauth.so

This line can limit access to the su command to users in the wheel group:

auth        required    pam_wheel.so use_uid

From the sound of it this is enabled and your userid isn't allowed to operate the su command.

SSH works since it goes through a different PAM mechanism. SSH also has it's own facilities for limiting access to root logins too. Root logins is typically permitted by default, at least on most of the Red Hat distros:

$ sudo grep PermitRoot /etc/ssh/sshd_config 
#PermitRootLogin yes
# the setting of "PermitRootLogin without-password".

Even though the above is commented out, it's the default, and is how OpenSSH shows it's the default setting in the configs.

Working with this?

If your system is configured like this, you can add your username to the wheel group.

$ useradd -G wheel saml

After logging out and back in:

$ groups
saml wheel

NOTE: My userid is "saml" above.

2. Permissions right on su?

Check that the executable is owned by root.

$ type -a su
su is /usr/bin/su
su is /bin/su

$ ls -l /usr/bin/su /bin/su
-rwsr-xr-x. 1 root root 32064 Jan 13 06:31 /bin/su
-rwsr-xr-x. 1 root root 32064 Jan 13 06:31 /usr/bin/su

Also confirm that the executables have their s bits enabled. This makes them setuid, so that when they're executed they run as their own, root.

3. What do the logs say?

When you attempt to do the su - command you should see entries in /var/log/secure about the attempt.

$ sudo grep su /var/log/secure | grep -v sudo
Feb 23 23:31:26 greeneggs su: pam_unix(su-l:session): session opened for user root by saml(uid=0)
Feb 24 00:27:32 greeneggs su: pam_unix(su-l:session): session closed for user root
Feb 24 01:34:12 greeneggs su: pam_unix(su-l:session): session opened for user root by saml(uid=1000)
Feb 24 01:34:26 greeneggs su: pam_unix(su-l:session): session closed for user root

Consult this log to see if you get any additional info.

4. Are you sure the password isn't the problem?

When I attempt to login using su - I get the following when I give it an incorrect password:

$ su -
Password: 
su: Authentication failure
$

I'd try creating another account and seeing if this secondary account can run su - successfully.

share|improve this answer
    
thank you by your great answer, what I tried after reading your answer : usermod -a -G wheel my_username , and the result of groups is fallah wheel. So the result of cat /etc/pam.d/su is now in my question, AND, again I'm not able to log in as root by su command !!! –  Alireza Fallah Feb 24 at 5:52
    
this is the last line of /var/log/secure : Feb 24 10:19:45 fallah su: pam_unix(su:auth): authentication failure; logname=fallah uid=501 euid=501 tty=pts/2 ruser=fallah rhost= user=root –  Alireza Fallah Feb 24 at 6:51
    
and this line is repeated about 20 times in /var/log/secure –  Alireza Fallah Feb 24 at 6:53
    
4 : but when I try : su: incorrect password - and the password is correct, because the I can log an with the same password in SSH –  Alireza Fallah Feb 24 at 7:39
    
I also tried to login with another account , like su alireza , and again the same problem –  Alireza Fallah Feb 24 at 8:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.