I have a Centos7 machine joined to an Active Directory domain. the problem is that if I login to the Centos7 server I can interact within the session with any username from the Active Directory domain.
I can deny the access trough ssh unless the user is in a specific group, but I can not achieve the users to do
su - different_user
different_user is any user within the active directory.
I think this might be achievable using
pam modules but do not know which one to use. I have tried the
pam_required.so which makes all the users not being able to
su to a different users account. Even to the ones which should have had access.