topic Re: Restricing sudo users from 'su -' in Operating System - HP-UX

Restricing sudo users from 'su -'

TD Clark — Mon, 22 Apr 2002 13:46:14 GMT

Hi all... I couldn't find any information on this in the man pages so I thought I'd try the forum. We'd like to give certain users access to every command (i.e. ALL=NOPASSWD: ALL), but we want to restrict them from logging in as root from sudo (i.e. sudo su -). Is this possible?

Thanks a bunch!

Re: Restricing sudo users from 'su -'

MANOJ SRIVASTAVA — Mon, 22 Apr 2002 13:56:33 GMT

Hi Todd

There is a simple way to do that ; here is a script we use for the user not to login as root , this can be expanded and used to restrict selective users too. These lineas are to be inserted in /etc/profile .

loginid=`who am i | awk '{print $1}'`

echo $loginid
if [ $loginid = root ]
then
exit
fi

Manoj Srivastava

Re: Restricing sudo users from 'su -'

S.K. Chan — Mon, 22 Apr 2002 13:59:30 GMT

This has good examples on how to configure your sudoers file to achieve what you want ..

http://www.courtesan.com/sudo/man/sudoers.html#examples

From the manual .. (some examples ..)
jen ALL, !SERVERS = ALL
The user jen may run any command on any machine except for those in host SERVERS

jill SERVERS = /usr/bin/, !SU, !SHELLS
For any machine in the SERVERS Host_Alias, jill may run any commands in the directory /usr/bin/ except for those commands belonging to the SU and SHELLS Cmnd_Aliases.

Re: Restricing sudo users from 'su -'

TD Clark — Mon, 22 Apr 2002 14:20:42 GMT

Thanks guys!