Su

lastmod 2020-11-18created 2020-11-183 edits

How to restrict the su command for the root account

Use pam_wheel (Linux PAM) to restrict the su command so that only wheel users can access it.

Add or modify the following in the /etc/pam.d/su file:

auth required pam_wheel.so use_uid

Add users to the wheel group. You can do this by editing the /etc/group file.

wheel:x:10:root,hong,kim

Change the permissions so that ordinary users cannot use the su command and only users in the wheel group can.

chgrp wheel /bin/su
chmod 4750 /bin/su

See also

• Linux
• InformationSecurity:CheckList:Unix - Checklist of security items for Unix-like systems.
• sudo

Favorite site

• (Linux security) How to restrict su for the root account