Allowing only certain user to su as another specific user.

[Daniel Nadler]

We have a group account that we need to specify only certain users to have the ability to su to this group account. We need it so that any other user not specified will not be able to su, even if they do have the password to the group account. Currently the only way to get into this group account is to su via your personal account, however anyone on the system can su to this group account if they have the correct password. We need to restrict only certain users this ability. Is this possible?

[RAC_1]

There two things that are coming to my mind.

sudo and custom script for su command.

[Suraj K Sankari]

Hi,

Implement sudo into your system and create separate account for all user.

Suraj

[Daniel Nadler]

I know there is already a file in place that restricts the group user from sshing to another host. I believe it's a sudoers file, but I am unable to locate it. I need some working example code before I submit this to the lead systems admin.

my idea as ksh code would be:

if [ "$loginname" = "Uid" -o "$loginname" = "Uid" ]
then
Allow group account connect
else
Deny group account connect
fi

Or some way of only users with a specific group associate with the id will allow user to su to group account.

Thanks in advance any help or suggestions provided.

[Daniel Nadler]

FYI - I am not a Sys Admin on these systems. I'm one of the users that will need access to su to the group account... along with other members of my team. Reason I am asking for help, is the password to this group account continually leaks out and users that shouldnt' be logging in as this group account are and are making changes that are impacting files that shouldn't be changed.

[Dennis Handly]

With RAC's comment about sudo, you enable sudo to allow anyone authorized to change to that account. And then you simply assign a random password to that user and don't tell anyone, even yourself. If you can "*" out that user and su still works, even better.