Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I know on my Gentoo system, the /etc/pam.d/su file comes with the following commented out:

auth       sufficient use_uid trust

Which allows a user to su to root without a password as long as he or she is in the wheel group. It also has an example using a list:

auth       sufficient item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass

I'm currently working with openSuse 11.4 and I successfully joined it to a domain using Yast (which automatically does all the winbind/kerberos/ad stuff) and was wondering if there was a way to modify the /etc/pam.d/su in openSuse to do the same thing if a user is in a specific AD group. I tried the following for my /etc/pam.d/su config:

auth     sufficient
auth     include        common-auth
auth     sufficient require_membership_of=MYDOMAIN\\LinuxAdmins
account  sufficient
account  include        common-account
password include        common-password
session  include        common-session
session  optional

But obviously that doesn't work. Is this possible using the module and if so, how?

share|improve this question

1 Answer 1

If you can get your AD group presented to the system as a unix group, you can use sudo instead. It's well suited to giving a wide range of root permissions to different users or groups.

The /etc/sudoers config for that would look something like this:

%LinuxAdmins ALL = NOPASSWD: ALL
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.