Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know on my Gentoo system, the /etc/pam.d/su file comes with the following commented out:

auth       sufficient   pam_wheel.so use_uid trust

Which allows a user to su to root without a password as long as he or she is in the wheel group. It also has an example using a list:

auth       sufficient   pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass

I'm currently working with openSuse 11.4 and I successfully joined it to a domain using Yast (which automatically does all the winbind/kerberos/ad stuff) and was wondering if there was a way to modify the /etc/pam.d/su in openSuse to do the same thing if a user is in a specific AD group. I tried the following for my /etc/pam.d/su config:

auth     sufficient     pam_rootok.so
auth     include        common-auth
auth     sufficient     pam_winbind.so require_membership_of=MYDOMAIN\\LinuxAdmins
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  include        common-session
session  optional       pam_xauth.so

But obviously that doesn't work. Is this possible using the pam_winbind.so module and if so, how?

share|improve this question

If you can get your AD group presented to the system as a unix group, you can use sudo instead. It's well suited to giving a wide range of root permissions to different users or groups.

The /etc/sudoers config for that would look something like this:

%LinuxAdmins ALL = NOPASSWD: ALL
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.