root access via su to be restricted

[Sanjiv Sharma_1]

Hi,

I want to allow root access via "su" to be restricted only to the members of the following two groups, say "adm" and "sap". How can I achieve this? No other users or group can su to root.

[A. Clay Stephenson]

Very simple. Change the root password and only tell the members of those groups. Seriously, the fundmental problem is that far too many people know your root password.

A safer method would be to identify just those tasks that need to be run as root and create a set of very explicit sudo'ed commands.

[Patrick Wallek · Accepted solution]

Have a look at the man page for 'security'. There is functionality within the /etc/default/security file called 'su_root_group', or something very similar. This will do precisely what you require.

[Sanjiv Sharma_1]

In /etc/default/security, SU_ROOT_GROUP=adm does help. Thanks