Assume I have a collection of unprivileged users (user01, user02, user03, ...) who are members of a Linux security group called 'x_users':
$ groups user01 user01 : user01 x_users
Further, assume I have a collection of admin users (admin01, admin02, admin03, ...) who are all members of a Linux security group called 'x_admins':
$ groups admin01 admin01 : admin01 x_admins
I want each member of the x_admin group to have the ability to use sudo(8) and su(1) to invoke an interactive login shell as any user who is a member of the x_users group, e.g.,
[admin01 ~]$ sudo su - user01 [user01 ~]$ # do stuff as user01 [user01 ~]$ exit [admin01 ~]$
Members of the x_admins group may not use sudo(8) and su(1) to invoke an interactive logon shell for any user who is not a member of the x_users group:
[admin01 ~]$ sudo su - nonxuser [sudo] password for admin01: Sorry, user admin01 is not allowed to execute '/bin/su - nonxuser' as root on localhost [admin01 ~]$
One way to accomplish this is to create a config file '/etc/sudoers.d/x_admins' as follows:
# /etc/sudoers.d/x_admins User_Alias ADMINS = %x_admins, %wheel ADMINS ALL = (root) /bin/su - user01 ADMINS ALL = (root) /bin/su - user02 ADMINS ALL = (root) /bin/su - user03 # ...
Of course, manually listing the individual members of the x_users group in a sudoers config file is tedious and error prone. Is there a more concise way of accomplishing this in the sudoers config file?