2

I have a Centos7 machine joined to an Active Directory domain. the problem is that if I login to the Centos7 server I can interact within the session with any username from the Active Directory domain.

I can deny the access trough ssh unless the user is in a specific group, but I can not achieve the users to do

su - different_user

Where different_user is any user within the active directory.

I think this might be achievable using pam modules but do not know which one to use. I have tried the pam_required.so which makes all the users not being able to su to a different users account. Even to the ones which should have had access.

|improve this question
  • Please clarify what you mean by "I can not achieve". Do the users get a password prompt? If not, what do they get instead? If they do and they enter a password, what happens? "can not achieve" is way too vague, sorry – Wouter Verhelst Nov 13 '17 at 16:39
  • "i can not achieve" - i can not deny the user to do "su - different_user" because anybody can do that once authenticated. of course i want to keep the option to run "su - allowed_user" available for the users – user37572 Nov 14 '17 at 8:47
0

If you want only certain users to be allowed as target for a su command, you could put the following in /etc/pam.d/su:

auth requisite pam_listfile.so onerr=fail item=user sense=allow file=/etc/su-users
auth required pam_unix.so

now if you create a file /etc/su-users with one user per line, then only users listed in that file can be su'ed to.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.