We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group.

The users that we want to permit to use the program 'su' are in the AD-Group: "test-group@example.com".

We are utilizing the following configuration in /etc/pam.d/su:

auth            required        pam_wheel.so use_uid

How do we achieve so that every user that is a member of AD-group "test-group@example.com" can use the program 'su'?

  • 1
    Have you considered sudo?, it is designed for this use-case, if give finer-grain control, and has logging. – ctrl-alt-delor Apr 2 at 8:09
  • Yes we are using sudo and will always use sudo. However, we don't want to completely disable su but limit it to certain users that are in said AD group. – nillenilsson Apr 2 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.