Restrict the use of su command
su is used to become another user during a login session. Invoked without a username, su defaults to becoming the super user. The user will be prompted for a password, if appropriate. Invalid passwords will produce an error message. All attempts, both valid and invalid, are logged to detect abuses of the system.
By default almost all distro allows to use su command. However you can restrict the use of su command for security reasons.
Both UNIX and Linux have a group called wheel. If user is member of this group she can use su command. We can add user to this group.
For example add existing user rocky to wheel group
# usermod -G wheel rocky
Now open /etc/pam.d/su PAM config file:
# vi /etc/pam.d/su
Append line as follows:
auth required /lib/security/pam_wheel.so use_uid
OR
auth required pam_wheel.so use_uid
Save and close the file.
Because of above setting only members of the administrative group wheel can use the su command. However I still recommend sudo over su for better control, security and ease of use. This is also default behavior on FreeBSD.
You may also be interested in other helpful articles:
- How to find out which network service are NOT linked against libwrap.s / tcpd (TCPWrapper)
- Linux Apache setting Perl CGI Script Limits
- Lighttpd restrict or deny access by IP address
- Is Linux server more secure than Windows server?
- Restricting zone transfers with IP addresses in BIND DNS Server
Discussion on This Article:
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Tags: /etc/pam.d/su, /lib/security/pam_wheel.so, administrative group, config, control security, default behavior, distro, error message, invalid passwords, lib, Linux, login session, PAM, security reasons, uid, UNIX, unix and linux, wheel, wheel group
Can we restrict multiple users using su command at a time ? Like user1 already using su - and working on some commands. Can we disallow using user2 at the same time ? Please let me know how can we configure this ?