how to setup " /usr/bin/su " can not be run by using sudo tools

[Eric Unix]

Hello All

If i want users can run all commands but only one command " /usr/bin/su" cannot be run. Then how to setup it.
I have try to setup is as follows :

eric prodsvr = noexec : /usr/bin/su

and login eric then run as follows :
$ sudo su
>>> sudoers file: syntax error, line 23 <<<
sudo: parse error in /usr/local/etc/sudoers near line 23

why ? someone help me ? Thanks a lot.

BR
eric

[Johnson Punniyalingam · Accepted solution]

commands "who am i" and "whoami". In an su situation, "who am i" will report the user you su from while
"whoami" will report the user you su to.

In this way, depending on the login shell you are using, you can modify .profile/.cshrc/.login of your
paticular user account accordingly to suit your needs.

For example, add the following to the beginning of your oracle's .profile:
=============================================
trap "" 1 2 3
if [ "who am i|awk '{print $1}' != "whoami" ]
then
# this implies an su, thus proceed on
# with the rest of your command executions.
else
# this user must have logged on direct
# without su'ing thus logout this user
logout
fi
trap 1 2 3
=============================================

To prevent your user from modifying his own .profile to workaround it, remember to change the ownership of oracle's .profile to root and chmod 755 the .profile.

Thanks,
Johnson

[OldSchool]

I don't believe the noexec works the way you think it does. Its used to prevent escaping from a "permitted" command to a shell, not to prevent a command from being run.
See:
http://www.courtesan.com/sudo/man/sudoers.html#noexec_and_exec

the example they give is:
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi

which allows aaron to run "more" and "vi", but not break out to a new shell from them which would allow them priviledge (root) access to everything.....

[Eric Unix]

Hello Johnson

Great, and it works now. Thank you very much.

Best Regards
Eric

[Javed Khan_1]

Hi,

Edit sudoers file add add

username ALL=(ALL) ALL, !/usr/bin/su

This will allow user to run all command except su


Regards,
Javed

[Kenan Erdey]

Hi,

you can prevent using sudo su - by :

username ALL=(ALL) ALL, !/usr/bin/su

but user still can copy /usr/bin/su to another location and can run with sudo and gain root access. i couln't find a solution to 'ALL' phrase.

Kenan.

[Dennis Handly]

>Kenan: but user still can copy /usr/bin/su to another location

Hmm, I first thought that may not work but it seems you may be right.