SU restrictions

[Jason Williams_10]

Is there any way to prevent certain users from su'ing to certain login ids. I would like to allow on group to su to an application login id but not another group. It is impossible to keep the password from spreading.

[Rick Garland]

SUDO is one of the better ways I have found. The loggin is good. If somebody tries then the ADMIN gets email that says so.

To prevent unauthorized root access, use the SU_ROOT_GROUP.

[Jason Williams_10]

We are using sudo too. However, this will not help in this particular situation. I know this can be done for root. That was not my question. I am looking to find out if it can be done for other id's.

[Rick Garland]

This can be done for other id's.

In the sudoers file you specify that a user cannot su -

An example:
!/usr/bin/su *id*

Do not allow this user (or group of users) to su to this particular userid.

This can be expanded on as there are other methods of doing the su.

But it can be done. I am doing it now.

[Rick Garland]

Another option that I am using. I am only specifing which users can su to an account. All other users are not included in the group. When they try the message "Not in SUDOERS" appears and ADMIN gets email

[Fred Ruffet]

In case your users log in the machine with their account then use su, using "who -m" still give their original connection id. So you can set up a line in .profile of prohibited user to exit if this id is not wanted...

Regards,

Fred

[Jason Williams_10]

Sounds promising.

So lets say I have a user "jay" and a super user "app". Lets say that "jay" is a member of the group "test" but not a member of the group "prod". If I wanted only member's of "prod" to be able to su to "app" after they are already logged into the system. What would I put in "app"'s .profile to accomplish this and keep "jay" out.

[Fred Ruffet]

In the following code (may be better, but done fast) "validGroups" are the groups id you may log in from.

---

originalUser=`who -m | awk '{print $1}'`
originalGroup=`(grep ${originalUser} /etc/group | cut -d: -f3 ; grep ${originalUser} /etc/passwd | cut -d: -f4) | xargs echo`
validGroups="20 0"
valid=0
for userGroup in ${originalGroup}
do
for validGroup in ${validGroups}
do
if [ ${validGroup} -eq ${userGroup} ]
then
valid=1
fi
done
done
if [ ${valid} -eq 0 ]
then
echo "UNAUTHORIZED LOGIN"
exit 1
fi

---

Regards,

Fred

[Jason Williams_10]

Thanks I'll give it a shot!

[Rick Garland]

The simplest method I have in my sudoers file is that I have a user that is allowed to su -

Nobody knows the passwd to the , it can only be reached by the valid entry in the sudoers file.

All other users not in the sudoers file are denied access and the log is appended to state that so-and-so tried with email sent to the ADMIN.