Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have disabled the root user login from Sshd.conf file so now no one can login using root user even if they know the password SOMEHOW.

Now I have 3 users in server ROOT,EMERG and ORACLE. I want to allow switching to ROOT only to EMERG user by using su - and not to ORACLE user.

because normally if users know the ROOT password they can switch to root using su -. And i want this feature available only to EMERG user.

How to do this

Thanks in advance......

share|improve this question
11  
Have a look at sudo it allows much better and finer grained access control. Plus it can authenticate users with their passwords. –  peterph Jan 22 '13 at 10:16
    
If my anser works for you, you may want to mark it as correct. –  Bananguin May 17 '13 at 7:00
add comment

1 Answer

su (mostly) uses pam for authentication and pam has a module called pam_wheel which checks group membership of the authenticating user. In short, by adding

auth       required   pam_wheel.so group=becomeroot

to the file /etc/pam.d/su, only users who are members of the group becomeroot may become root using su. Now you make sure only your user EMERG is a member of the group becomeroot. Some distros have/use the group named wheel for that.

groupadd becomeroot         #add the group becomeroot to your system
gpasswd -a EMERG becomeroot # add the user EMERG to the group becomeroot

Further reading: pam (7) pam_wheel (8) groupadd (8) gpasswd (1) and many distros have explaining comments in /etc/pam.d/su as well

share|improve this answer
    
Not all distributions have a wheel group, or it could be named differently. –  vonbrand Jan 22 '13 at 19:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.