It's not possible - please read to the very end. If the user has full sudo access, they can always use sudo -i -u root
, sudo /usr/bin/bash
, sudo /usr/bin/{ANY_OTHER_SHELL}
or write their own script/program that will use a few commands to get to full shell access. It's trivial. They can also revert any configuration changes that you made etc. You might obscure it a little by changing the default root shell to /sbin/nologin
.
[vagrant@eurolinux8-vbuilder ~]$ sudo chsh root -s /sbin/nologin
Changing shell for root.
chsh: Warning: "/sbin/nologin" is not listed in /etc/shells.
Shell changed.
[vagrant@eurolinux8-vbuilder ~]$ sudo -i
This account is currently not available.
But any power user can use "naked" bash invocation with sudo:
[vagrant@eurolinux8-vbuilder ~]$ sudo /usr/bin/bash
[root@eurolinux8-vbuilder vagrant]#
So obscuring access with /usr/sbin/nologin
is not very potent.
You can also add some script to bash or any other shell configuration to check if the user is root
that will print messages like Please use sudo
and log out. But once more, power users will be able to use things like --norc
and --noprofile
or point their own configuration to bash. To sum it up - according to my best knowledge it's not possible. I even check if there are some exceptional cases [for example, with PAM] when using a user that normally is daemon only (like httpd). But with httpd
installed you can also use sudo -u apache /usr/bin/bash
. Maybe there is some PAM based solution, but with google-fu, I was unable to find them. It's also hard because you are interested in disabling interactive access. In another case (disabling access to root fully), you will brick the system, and you will have to fix it in recovery mode.
But there is a solution that you might be more interested in - terminal logging.
You want to know terminal history, not limit access entirely. In the meantime, you should know that users with full admin access can remove their log - so just in case, you should use rsyslog or other logging solution to put logs to the different server.
Because you are using RHEL based distro - you might read the following. https://www.redhat.com/sysadmin/terminal-logging
sudo su
relevant? That's never particularly useful, either your users have the root password and can runsu
directly or they don't and they can dosudo -i
. Also, what operating system is this? That's an important detail. Please edit your question, tell us your OS and clarify if the system has an activatedroot
account and whether your users have the root password. Is removingsudo
and sticking withsu
and then giving the root password only to those users in your target group an option?sudo su
is pointless. I know that Ubuntu users praise it, but it's still pointless. Yoursudo
command gets root for the current user (and it's this that you need to address), and then it askssu
, which is now already root, to become root. Much easier and clearer to usesudo -s
and avoid doubling up withsu
at all