I am a system administrator and I do not want users to use su - $appuser and try entering the password of the app user


use sudo su - $appuser and enter their own password.

Some naïve users who are not aware try to do su - $appuser and enter an incorrect password, by doing this the application user gets locked after 3 unsuccessful attempts (defined by the AD team; cannot be changed). We want to force users to use sudo su -

Can this be achieved ?

  • Which OS is this?
    – muru
    Jan 17 '17 at 4:20
  • 2
    Why sudo su? It's a horrible construct and totally unnecessary.
    – roaima
    Jan 17 '17 at 20:31

Well, you could always use the traditional BSD-route...

Create a group - wheel is the traditional name...

Add users allowed to use su into this group - in your case, none (maybe except root, but root is allowed anyway).

Set the group-ownership of su to wheel

Take away others execution-rights for su

By the end, su should have root:wheel ownership, and it's permission should be: rws--x--- (ie. chmod u=rwxs,g=x,o= su) (or even better; --s--x--- ; ie. chmod u=xs,g=x,o= su)

This will prevent anybody but root and members of wheel from executing su. Since using sudo effectively makes any user root, sudo su ... should also work.

  • There isn't really much gained from removing a+r on /bin/su. At least if it's the one your distro ships—anyone can just download it from the Internet.
    – derobert
    Jan 18 '17 at 22:03

If you're on a system that uses PAM (e.g., almost all Linux systems), then you have a few more options.

  1. Edit /etc/pam.d/su and add a line like su auth required pam_wheel.so before your LDAP/AD/etc. authentication. This gives you the wheel group, through PAM instead of file ownership. You can also do much more flexible things using pam_succeed_if.
  2. Edit the same, and either change auth sufficient pam_rootok.so (which lets root use su) to auth required pam_rootok.so (to let only root use su), or alternatively put auth required pam_deny.so at some point.
  3. Same file, you could do something like auth required pam_succeed_if.so uid ne $appuser to just block su to the app user.

I apologize in advance I haven't tested any of those.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.