I know on my Gentoo system, the /etc/pam.d/su file comes with the following commented out:

auth       sufficient   pam_wheel.so use_uid trust

Which allows a user to su to root without a password as long as he or she is in the wheel group. It also has an example using a list:

auth       sufficient   pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass

I'm currently working with openSuse 11.4 and I successfully joined it to a domain using Yast (which automatically does all the winbind/kerberos/ad stuff) and was wondering if there was a way to modify the /etc/pam.d/su in openSuse to do the same thing if a user is in a specific AD group. I tried the following for my /etc/pam.d/su config:

auth     sufficient     pam_rootok.so
auth     include        common-auth
auth     sufficient     pam_winbind.so require_membership_of=MYDOMAIN\\LinuxAdmins
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  include        common-session
session  optional       pam_xauth.so

But obviously that doesn't work. Is this possible using the pam_winbind.so module and if so, how?


If you can get your AD group presented to the system as a unix group, you can use sudo instead. It's well suited to giving a wide range of root permissions to different users or groups.

The /etc/sudoers config for that would look something like this:

%LinuxAdmins ALL = NOPASSWD: ALL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.