Allow su without password for users in a particular Active Directory group when using pam_winbind

Question

I know on my Gentoo system, the /etc/pam.d/su file comes with the following commented out:

auth       sufficient   pam_wheel.so use_uid trust

Which allows a user to su to root without a password as long as he or she is in the wheel group. It also has an example using a list:

auth       sufficient   pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass

I'm currently working with openSuse 11.4 and I successfully joined it to a domain using Yast (which automatically does all the winbind/kerberos/ad stuff) and was wondering if there was a way to modify the /etc/pam.d/su in openSuse to do the same thing if a user is in a specific AD group. I tried the following for my /etc/pam.d/su config:

#%PAM-1.0
auth     sufficient     pam_rootok.so
auth     include        common-auth
auth     sufficient     pam_winbind.so require_membership_of=MYDOMAIN\\LinuxAdmins
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  include        common-session
session  optional       pam_xauth.so

But obviously that doesn't work. Is this possible using the pam_winbind.so module and if so, how?

Answer 1

If you can get your AD group presented to the system as a unix group, you can use sudo instead. It's well suited to giving a wide range of root permissions to different users or groups.

The /etc/sudoers config for that would look something like this:

%LinuxAdmins ALL = NOPASSWD: ALL