su restrictions on HPUX 11.23

[Sajjad Premier]

Hi,

We need to enable passwords for root users when using su like "joroot" user has UID 0 or equivalent to root user. "joroot" can use "su - root" without password.

Query is if "joroot" is applying command "su - root", it must be prompt for password.

Thanks & Kind Regards,

Muhammad Ali

[Dennis Handly]

Since joroot has UID 0, it IS root and there is no need to do su nor check passwords.

[unixinfopk]

Hi,

Still is there any possibility when joroot try to use "su - root" then it prompts for root password?

we need to implement this restriction as our internal requirement.

Thanks & Kind Regards,

Muhammad Ali

[Dennis Handly]

Even if it asked for a password, joroot would simply never use su since he IS root already.

[Naj]

Hi,

i do not sure what are you trying to achive.

joroot itself UID 0 and why you need su -  and next step asking for password?

once the user owned UID 0, they can do anything event you put marvellous script such asking password su -, they can revert back.

Thanks

BR

Naj

[unixinfopk]

Hi,

I know joroot has UID 0. But some users used to su - root and perform some tasks although they can use their userid like joroot since we want to monitor joroot activity but we are unable to track when they perform administrative tasks by using su - root.

That's why we want to restrict joroot to prompt for a password when using su - root.

Thanks & Kind Regards,

Muhammad Ali

[Naj]

Hello,

Did joroot one of sudo user?
could you please be more specific what task that joroot not be perform?

Thanks

BR
Naj

[Dennis Handly]

How are you monitoring joroot activity?

Perhaps you should be using a management tool and not a software tool to manage your rogue sysadmins?

[unixinfopk]

Hello,

Thanks for your reply.

Is there possiblity in hpux to prompt for a password when any user having uid 0 use su - root ?

if not then how to disable su?   

Thanks & Kind Regards,

Muhammad Ali

[unixinfopk]

Hi,

By Audit trail.

Kindly suggest which management tool we can use to monitor root users activity?

Thanks & Kind Regards,

Muhammad Ali