I have a Centos7 machine joined to an Active Directory domain. the problem is that if I login to the Centos7 server I can interact within the session with any username from the Active Directory domain.
I can deny the access trough ssh unless the user is in a specific group, but I can not achieve the users to do
su - different_user
Where different_user
is any user within the active directory.
I think this might be achievable using pam
modules but do not know which one to use. I have tried the pam_required.so
which makes all the users not being able to su
to a different users account. Even to the ones which should have had access.