1

This is similar to this question:

Allow user1 to "su - user2" without password

However, the solution only work for multiple users accessing "su"ing ONE user.

#works fine :) 2 or more users accessing 1 user
auth       [success=ignore default=1] pam_succeed_if.so user = user1
auth       sufficient   pam_succeed_if.so use_uid user = user2
auth       sufficient   pam_succeed_if.so use_uid user = user3

If I try to go n-users to n-users:

#dont work :(
auth       [success=ignore default=1] pam_succeed_if.so user = user1
auth       sufficient   pam_succeed_if.so use_uid user = user2
auth       sufficient   pam_succeed_if.so use_uid user = user3

auth       [success=ignore default=1] pam_succeed_if.so user = user4
auth       sufficient   pam_succeed_if.so use_uid user = user2
auth       sufficient   pam_succeed_if.so use_uid user = user3

I get PAM errors or get asked for input the password.

  • 2
    sudo is designed exactly for this... – Aaron D. Marasco Mar 16 '16 at 23:22
  • I'm working in a environment that sadly I do not have access to changing 'sudoers' file. However I do have root user access. So I'm trying to workaround with passwordless "su". – rafaelxy Mar 17 '16 at 14:04
1

You need to change the auth order, like this:

auth       [success=1 default=ignore] pam_succeed_if.so user = user1
auth       [success=ignore default=1] pam_succeed_if.so user = user4
auth       sufficient   pam_succeed_if.so use_uid user in user2:user3
  • 1
    Welcome on the Unix SE! Help in pam things is always very useful. However, writing just code/script/config snippets reduces the mean quality of the site. Please explain, what did you change and why. – user259412 Jul 29 '18 at 18:35
  • this solved it for me, allowing su without password into user1 and user4 – simernes Oct 8 '18 at 6:42
0

As I understand it, the code [success=ignore default=1] means that if the module returns anything other than success, skip 1 module. Perhaps you need to skip 2 to get to the next pam_succeed_if ?

  • I tried using [success=ignore default=2] but didn't work. I get the message "could not set PAM credentials" everytime for the first auth declaration. The second always works, seems like it is overwriting the other one. – rafaelxy Mar 17 '16 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.