I know on my Gentoo system, the /etc/pam.d/su file comes with the following commented out:
auth sufficient pam_wheel.so use_uid trust
Which allows a user to su to root without a password as long as he or she is in the wheel group. It also has an example using a list:
auth sufficient pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass
I'm currently working with openSuse 11.4 and I successfully joined it to a domain using Yast (which automatically does all the winbind/kerberos/ad stuff) and was wondering if there was a way to modify the /etc/pam.d/su in openSuse to do the same thing if a user is in a specific AD group. I tried the following for my /etc/pam.d/su config:
#%PAM-1.0 auth sufficient pam_rootok.so auth include common-auth auth sufficient pam_winbind.so require_membership_of=MYDOMAIN\\LinuxAdmins account sufficient pam_rootok.so account include common-account password include common-password session include common-session session optional pam_xauth.so
But obviously that doesn't work. Is this possible using the pam_winbind.so module and if so, how?