We are using NIS services for users login for Unix accounts. We have test machines where users themselves install OS and they get root access. Users are using su from root account to NIS user accounts without passwords they are able to enter other NIS accounts easily. Is there any way we can restrict this option? I don't want allow any root user to login other users nis account.
Yes, there is a way to restrict this behaviour. This behaviour of su is governed by the PAM module (Plugable Authentication Module):
You must edit
comment the line :
auth sufficient pam_rootok.so
#auth sufficient pam_rootok.so
after that su from root will ask for the user password.