topic Re: access controls on su in Operating System - HP-UX

access controls on su

skt_skt — Fri, 25 Apr 2008 18:24:03 GMT

In Linux, following files controle the su access

# ll /etc/security/su*
-rw-r--r-- 1 root root 8 Feb 15 2006 /etc/security/suapplmgr
-rw-r--r-- 1 root root 7 Feb 15 2006 /etc/security/suoracle
-rw-r--r-- 1 root root 5 Feb 15 2006 /etc/security/suroot

is there an equivalent in HP-UX or an alternate method!

Re: access controls on su

Tim Nelson — Fri, 25 Apr 2008 18:42:13 GMT

As far as I know.

1) su access is only limited to knowing the password of who you are su'ing to

2) if not root then permissions are controlled by standard file permissions and some directives defined in /etc/defaults/security

3) I see others typically use sudo (3rd party app) for this purpose.

man su
or
man security

for more.

Re: access controls on su

Srini Jay — Fri, 25 Apr 2008 18:50:42 GMT

To control who can 'su - root', you can do the following:

1) Create a unique group (say 'some_unique_group')

2) add the following line to /etc/default/security file:
SU_ROOT_GROUP=some_unique_group

3) add the users who should should be allowed to do 'su root' to this group:

in file /etc/group:

some_unique_group::GID:user1,user2,user3...

Not sure if there is a way restrict 'su' to other non-root account.

thanks,
sj

Re: access controls on su

VK2COT — Fri, 25 Apr 2008 20:27:07 GMT

Hello,

a) The method you showed in Linux is based
on PAM.

Since HP-UX supports PAM, I guess it
is possible to do it. In fact,
when I get back from a business trip in two
weeks, I will try it myself.

b) The second option would be SUDO with SUDOSH.

That one I have implemented for a large
company running Solaris, Linux and HP-UX.

c) Finally, if you use HP-UX 11.23 or 11.31,
go for Role Based Access Control (RBAC).

Such a good tool, used so little in HP-UX.
Pity.

Cheers,

VK2COT

Re: access controls on su

skt_skt — Mon, 26 Jan 2009 00:43:41 GMT

[ghosha@/home/ghosha] #su -
Password:
Last successful login for root: Fri Jan 23 09:48:35 EST5EDT 2009
Last unsuccessful login for root: Thu Jan 22 12:04:28 EST5EDT 2009
su: Not a member of the SU_ROOT_GROUP defined in /etc/default/security
[ghosha@/home/ghosha] #

su to root account is prevented if the users are NOT members of easroot. But NOT available for any other accounts.