Allow only specific users to interact with the local session

Question

I have a Centos7 machine joined to an Active Directory domain. the problem is that if I login to the Centos7 server I can interact within the session with any username from the Active Directory domain.

I can deny the access trough ssh unless the user is in a specific group, but I can not achieve the users to do

su - different_user

Where different_user is any user within the active directory.

I think this might be achievable using pam modules but do not know which one to use. I have tried the pam_required.so which makes all the users not being able to su to a different users account. Even to the ones which should have had access.

Answer 1

If you want only certain users to be allowed as target for a su command, you could put the following in /etc/pam.d/su:

auth requisite pam_listfile.so onerr=fail item=user sense=allow file=/etc/su-users
auth required pam_unix.so

now if you create a file /etc/su-users with one user per line, then only users listed in that file can be su'ed to.