Disallow su to login

[Al Langen_2]

We have an application that requires root privileges to run but prevents users
who login from gaining shell access. If a user su's to the login for this
application, they are granted full root privileges and are given access to the
shell.
Short or rewriting su, is there some way of preventing a login access through
su (outside of su -)?

[Thotam setty Gupta]

One way is to make your system a trusted system. This disallows everybody
except root to su.

[Willaim Hart]

you might try using the /etc/group file.
you can create user groups and associated privileges.
check your system documentation for specifics.
associated files are /etc/group and /etc/logingroup
and the setprivgrp command.

[Joey Sta. cruz_1]

hi,

run this command "lsacl /usr/bin/su" this will check which users has su
access. Should see similar to this
(root.%,r-x)(%.bin,r-x)(%.%,r-x) /usr/bin/su

on the 3rd parenthesis which (%.%,r-x) it allows all users to use su command.
You can define specific users to access su command. Please refer to man page
on using chacl

Regards
Joey