Your question is a bit confusing. I think you want to prevent users from running commands as root. If that's what you want:
- Don't give them the root password. If they already have the root password, change it.
- Don't allow them to use
sudo
to run commands as root. Remove them from the suoders
file.
Forbidding users from running a few commands such as su
and bash
while allowing users is completely useless. They'll be able to run any of hundreds of commands that allow running other commands (sh
, env
, perl
, vi
, nethack
, gcc
…). You can't achieve any extra security by blacklisting a few commands. If you don't want users to be allowed to run commands as root, don't allow them to run commands as root: keep them out of the sudoers
file, or only allow a carefully chosen set of commands which do not provide a way to run a shell or to overwrite arbitrary files.
It's possible to set up a wheel group such that only users in that group can become root by running su
, even if they know the root password. However, this is not really useful since user who know the root password can log in with login
. Again, if there are users who know the root password but shouldn't, that's what you need to address.
sudoers
file will be able to run sudo and you need the user's password to switch users withsu
. I don't understand what more you need.su
will do nothing. If you start with a compromisedroot
account you will never have a secure system.