13

I have disabled the root user login from Sshd.conf file so now no one can login using root user even if they know the password SOMEHOW.

Now I have 3 users in server ROOT,EMERG and ORACLE. I want to allow switching to ROOT only to EMERG user by using su - and not to ORACLE user.

because normally if users know the ROOT password they can switch to root using su -. And i want this feature available only to EMERG user.

How to do this

Thanks in advance......

Improve this question
2
  • 11
    Have a look at sudo it allows much better and finer grained access control. Plus it can authenticate users with their passwords.
    – peterph
    Jan 22, 2013 at 10:16
  • 1
    If my anser works for you, you may want to mark it as correct.
    – Bananguin
    May 17, 2013 at 7:00

1 Answer 1

Reset to default
16

su (mostly) uses pam for authentication and pam has a module called pam_wheel which checks group membership of the authenticating user. In short, by adding 

auth       required   pam_wheel.so group=becomeroot

to the file /etc/pam.d/su, only users who are members of the group becomeroot may become root using su. Now you make sure only your user EMERG is a member of the group becomeroot. Some distros have/use the group named wheel for that.

groupadd becomeroot         #add the group becomeroot to your system
gpasswd -a EMERG becomeroot # add the user EMERG to the group becomeroot

Further reading: pam (7) pam_wheel (8) groupadd (8) gpasswd (1) and many distros have explaining comments in /etc/pam.d/su as well

Improve this answer
1
  • 2
    Not all distributions have a wheel group, or it could be named differently.
    – vonbrand
    Jan 22, 2013 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .