topic su command restiction in Operating System - HP-UX

su command restiction

gany59 — Fri, 19 Jun 2009 18:18:38 GMT

how to restict the specific user for using the su command. [e.g] the user name is cbeny..please let me know.. i have to perform in a server .. Thanks in advance .. points assured

Re: su command restiction

OldSchool — Fri, 19 Jun 2009 18:56:58 GMT

if "cbeny" knows the password of the "target" user, you can't disable "su".

you could place "cbeny" in a resticted shell, but that may be overkill for what you want to accomplish

you could write a wrapper script for the std "su" that looks at who ran it before doing the real "su"

you could use "sudo", or "PowerBroker"

Re: su command restiction

Michael Steele_2 — Fri, 19 Jun 2009 19:10:39 GMT

Hi:

As OldSchool mentions, 'switch-user' or 'su' is password authenticated and a password will be posed everytime unless starting from root and going to a user account. 'root' is not authenticated with 'su', only user accounts are.

If the issue is with 'su - root' from a user account then you can convert to a trusted system and live with those nusances, but I think popularity for trusted systems had really diminished since 10.20 and 11.00.

You can also use the even less popular NIS Plus and get the same root restirctions. But I have yet to find an HP-UX box using NIS Plus. Its very unpopular.

Re: su command restiction

VK2COT — Fri, 19 Jun 2009 22:43:28 GMT

Hello,

Apart from the advice you already got from
others, here are other options:

a) Set option SU_ROOT_GROUP in /etc/default/security and add user "cbeny" if
they are allowed to su(1) to "root".

Or, if you do not want "cbeny" to be able to
su(1) to "root", then make them not be
part of Unix group as defined in SU_ROOT_GROUP.

b) Change permissions on /usr/bin/su (normally 4555, owner root, group bin or
root), to a more restrictive, say 4550:

-r-sr-x--- 1 root sugrp ... /usr/bin/su

Then, create a sugrp in /etc/group. Add
the users that are allowed to run su(1) to
membership of the Unix group sugrp.

c) Finally, think about using
Role Based Access Control.

Cheers,

VK2COT

Re: su command restiction

Michael Steele_2 — Sat, 20 Jun 2009 01:41:10 GMT

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1349273