0

I have been asked to implement sudo rules such that a non privileges user should be able to switch to other users but not root. i tried couple of things as below but with no avail.

Cmnd_Alias SU = /bin/su - root
%XXXX_GROUP     ALL=(!root) NOPASSWD: ALL, !SU, !ADMIN, !SHELLS
===============================================================
Cmnd_Alias SU = /bin/su - !root
%XXXX_GROUP     ALL=(ALL) NOPASSWD: ALL, SU, !ADMIN, !SHELLS
================================================================

I have searched a lot but could not find any solution or similar questions. Can you please help me in this regard?

Thanks in advance

  • 2
    You don't need (and shouldn't use) sudo su. In effect it says, "Hello sudo, please can I have root? Ah, thank you. Now then. Hello su, although I'm already root please can I have root? Thank you." You can use sudo -s -u {user} without needing to use su anywhere, which may make your rules easier too. – roaima Sep 10 at 5:28
  • @muru I think the point is that they want to disallow "root" to be the target user of the sudo command, i.e. they want to be able switch between several non-privileged user accounts and disallow switching to root. – Kusalananda Sep 10 at 5:42
  • @Kusalananda ah, I misread. – muru Sep 10 at 5:50
  • @roaima, thank you, I suggested this usage "sudo -s -u <<user>>. Let me see how it fits their use case. – LostJedi Sep 10 at 5:59
  • 1
    Depending on the configuration of sudo, the sudo -s -u <user> may result in an environment that has the $HOME of the original user but the identity of the target user. For some situations, that might be useful; in others, it might be undesirable. If your version of sudo is not out of date for more than about 15 years, you'll have sudo -i -u <user> which will be an exact equivalent of sudo su - <user>. It will always switch the home directory, and will cause the login scripts of the target user to be executed to re-initialize the environment. – telcoM Sep 10 at 6:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.